quarkusio/quarkus · error · IllegalStateException

You must override this method or IdentityProvider.authentica

Error message

You must override this method or IdentityProvider.authenticate

What it means

In the lambda-http extension, LambdaIdentityProvider.authenticate(APIGatewayV2HTTPEvent) is a default method that must be overridden. The Quarkus SecurityIdentityProvider.authenticate implementation will delegate to this method; if not overridden it throws IllegalStateException, since there is no default authentication behavior.

Source

Thrown at extensions/amazon-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/LambdaIdentityProvider.java:40

    @Override
    default Uni<SecurityIdentity> authenticate(LambdaAuthenticationRequest request, AuthenticationRequestContext context) {
        APIGatewayV2HTTPEvent event = request.getEvent();
        SecurityIdentity identity = authenticate(event);
        if (identity == null) {
            return Uni.createFrom().optional(Optional.empty());
        }
        return Uni.createFrom().item(identity);
    }

    /**
     * You must override this method unless you directly override
     * IdentityProvider.authenticate
     *
     * @param event
     * @return
     */
    default SecurityIdentity authenticate(APIGatewayV2HTTPEvent event) {
        throw new IllegalStateException("You must override this method or IdentityProvider.authenticate");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Override SecurityIdentity authenticate(APIGatewayV2HTTPEvent event) in your provider bean
If you do not need custom auth, remove the LambdaIdentityProvider bean or disable the auth mechanism
Extend a provided base implementation rather than implementing the interface raw
Match the exact method signature for the extension version you use

Example fix

// before
public class MyIdentityProvider implements LambdaIdentityProvider {}
// after
public class MyIdentityProvider implements LambdaIdentityProvider {
    @Override
    public SecurityIdentity authenticate(APIGatewayV2HTTPEvent event) {
        return SecurityIdentity.builder().build();
    }
}

Defensive patterns

Strategy: validation

Validate before calling

// startup check
LambdaIdentityProvider p = ...;
if (p.getClass().getMethod("authenticate", APIGatewayV2HTTPEvent.class)
        .getDeclaringClass() == LambdaIdentityProvider.class) {
    throw new IllegalStateException("Override authenticate(APIGatewayV2HTTPEvent)");
}

Type guard

boolean overridesAuthenticate(LambdaIdentityProvider p) {
    try {
        return p.getClass().getMethod("authenticate", APIGatewayV2HTTPEvent.class)
                .getDeclaringClass() != LambdaIdentityProvider.class;
    } catch (NoSuchMethodException e) { return false; }
}

Try / catch

try { identity = provider.authenticate(event); } catch (IllegalStateException e) { return anonymousIdentity(); }

Prevention

Always override authenticate(event) when implementing LambdaIdentityProvider
Don't share provider classes between lambda-http and lambda-rest extensions
Add a unit test that calls authenticate with a sample event

When it happens

Trigger: Registering a bean implementing LambdaIdentityProvider (lambda-http) but relying on the default authenticate(event) method without overriding it, and a request then attempts authentication.

Common situations: Implementing the interface without implementing authenticate; implementing the wrong method signature after a version change; expecting the interface to be optional when security is configured.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/d7fd288722cef0c5. Report an issue: GitHub.