quarkusio/quarkus · error · IllegalStateException

You must override this method or IdentityProvider.authentica

Error message

You must override this method or IdentityProvider.authenticate

What it means

Same contract as the lambda-http variant but for the lambda-rest extension: LambdaIdentityProvider.authenticate(AwsProxyRequest) is a default method that must be overridden when the provider is used, otherwise IllegalStateException is thrown during authentication.

Source

Thrown at extensions/amazon-lambda-rest/runtime/src/main/java/io/quarkus/amazon/lambda/http/LambdaIdentityProvider.java:39

    @Override
    default Uni<SecurityIdentity> authenticate(LambdaAuthenticationRequest request, AuthenticationRequestContext context) {
        AwsProxyRequest event = request.getEvent();
        SecurityIdentity identity = authenticate(event);
        if (identity == null) {
            return Uni.createFrom().optional(Optional.empty());
        }
        return Uni.createFrom().item(identity);
    }

    /**
     * You must override this method unless you directly override
     * IdentityProvider.authenticate
     *
     * @param event
     * @return
     */
    default SecurityIdentity authenticate(AwsProxyRequest event) {
        throw new IllegalStateException("You must override this method or IdentityProvider.authenticate");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Override SecurityIdentity authenticate(AwsProxyRequest event) in your provider bean
Remove the provider bean if custom authentication is not needed
Ensure the event-type signature matches the extension (AwsProxyRequest for rest, APIGatewayV2HTTPEvent for http)

Example fix

// before
public class MyIdentityProvider implements LambdaIdentityProvider {}
// after
public class MyIdentityProvider implements LambdaIdentityProvider {
    @Override
    public SecurityIdentity authenticate(AwsProxyRequest event) {
        return SecurityIdentity.builder().build();
    }
}

Defensive patterns

Strategy: validation

Validate before calling

LambdaIdentityProvider p = ...;
if (p.getClass().getMethod("authenticate", AwsProxyRequest.class)
        .getDeclaringClass() == LambdaIdentityProvider.class) {
    throw new IllegalStateException("Override authenticate(AwsProxyRequest)");
}

Type guard

boolean overridesAuthenticate(LambdaIdentityProvider p) {
    try {
        return p.getClass().getMethod("authenticate", AwsProxyRequest.class)
                .getDeclaringClass() != LambdaIdentityProvider.class;
    } catch (NoSuchMethodException e) { return false; }
}

Try / catch

try { identity = provider.authenticate(event); } catch (IllegalStateException e) { return anonymousIdentity(); }

Prevention

Use AwsProxyRequest-typed providers only with the lambda-rest extension
Always implement authenticate(event) in your provider
Unit-test providers with a sample AwsProxyRequest before deployment

When it happens

Trigger: Registering a LambdaIdentityProvider for REST (AwsProxyRequest) API Gateway events without overriding authenticate(event); an authenticated request then hits the default method.

Common situations: Copy-pasting an identity provider between lambda-http and lambda-rest extensions and keeping the wrong event type signature; implementing the interface without custom authentication logic.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2edab0b580c834bc. Report an issue: GitHub.