quarkusio/quarkus · error · InternalServerErrorException

This method must not be invoked

Error message

This method must not be invoked

What it means

This endpoint is a negative-control in the oidc-code-flow integration test: it must never be reached because the OIDC filter is expected to redirect the unauthenticated request to Keycloak before the request reaches the resource. Hitting it means the expected authentication redirect did not happen, so the resource throws InternalServerErrorException to fail the test loudly.

Source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource.java:172

    @Path("tenant-split-tokens")
    public String getNameSplitTokens(@CookieParam("q_session_tenant-split-tokens") String idToken,
            @CookieParam("q_session_at_tenant-split-tokens") String accessToken,
            @CookieParam("q_session_rt_tenant-split-tokens") String refreshToken) {
        return String.format(
                "tenant-split-tokens:%s, id token has %d parts, access token has %d parts, refresh token has %d parts",
                getName(), idToken.split("\\.").length, accessToken.split("\\.").length, refreshToken.split("\\.").length);
    }

    @GET
    @Path("tenant-split-id-refresh-token")
    public String getNameIdRefreshSplitTokens() {
        return "tenant-split-id-refresh-token:" + getName();
    }

    @GET
    @Path("callback-before-wrong-redirect")
    public String getNameCallbackBeforeWrongRedirect() {
        throw new InternalServerErrorException("This method must not be invoked");
    }

    @GET
    @Path("callback-before-redirect")
    public String getNameCallbackBeforeRedirect() {
        throw new InternalServerErrorException("This method must not be invoked");
    }

    @GET
    @Path("callback-after-redirect")
    public String getNameCallbackAfterRedirect() {
        return "callback:" + getName();
    }

    @GET
    @Path("callback-jwt-before-redirect")
    public String getNameCallbackJwtBeforeRedirect() {
        throw new InternalServerErrorException("This method must not be invoked");

View on GitHub (pinned to e1c734241f)

Solutions

1. Check quarkus.oidc.* configuration (auth paths, redirect URI, tenant settings) so this path is actually protected and triggers a code-flow redirect
2. Confirm the OIDC extension's authentication mechanism is enabled and Keycloak is reachable so the redirect is issued
3. Update the integration test expectations if the intended redirect behavior changed
4. If seen in production code, replace this sentinel pattern with proper deny/redirect logic — it exists only as a test tripwire

try { return resource.call(); } catch (javax.ws.rs.InternalServerErrorException e) { assertRedirectHappened(); }

When it happens

Trigger: An HTTP GET to /protected/callback-before-wrong-redirect actually reaches the JAX-RS method, meaning the OIDC code-flow authentication mechanism failed to redirect the caller to the OIDC provider before resource dispatch.

Common situations: The OIDC redirect path/tenant configuration is wrong so the request is dispatched to the resource instead of Keycloak; a test change removed the required authentication on this path; quarkus.oidc.code-flow or redirect-params settings changed so the wrong-redirect scenario no longer triggers a redirect.

Related errors

• SecurityIdentity must have a RoutingContext attribute
• Access token values are not equal
• Refresh token values are not equal
• The '%s' property can only be set to 'idtoken' for WEB_APP a
• '%s' must be enabled to use '%s'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8ed58c1ef48029c2. Report an issue: GitHub.