This is an issue when a class implements a credential provider interface and is annotated with a dependency injection scope annotation (such as application-scoped) but is missing the annotation that prevents removal during framework optimization.

In Java with CDI and Quarkus, this specifically refers to classes implementing the CredentialsProvider interface, annotated with @ApplicationScoped (or other CDI scope annotations), and missing the @Unremovable annotation.

Why is this an issue?

In applications using frameworks with build-time optimization, the dependency injection container performs compile-time analysis to reduce the runtime footprint. During this optimization phase, the container analyzes which components are actually used and may remove components that appear to have no injection points or explicit references.

Custom implementations of service provider interfaces are discovered and used at runtime through the framework’s plugin or extension mechanism. However, because these providers are typically not injected directly into other components, the dependency injection container cannot detect their usage during build-time analysis.

Without explicit preservation annotations or configuration, the dependency injection container may incorrectly conclude that the custom service provider component is unused and eliminate it during optimization. This leads to a situation where:

• The application builds successfully without warnings
• The service provider component is not available at runtime
• Authentication attempts fail when the application tries to retrieve credentials
• The root cause is difficult to diagnose because the failure occurs at runtime rather than build time

Preservation annotations or configuration directives explicitly instruct the dependency injection container to retain the component during optimization, ensuring it remains available for runtime discovery through the service provider interface mechanism.

What is the potential impact?

When a custom credentials provider implementation lacks annotations that prevent removal during build-time optimization, the dependency injection framework may eliminate the implementation as apparently unused. This results in runtime authentication failures when the application attempts to retrieve credentials from the provider.

The application will build successfully, making the issue particularly difficult to detect during development. The failure only manifests when the credentials provider is actually invoked, which could be:

• During application startup when establishing database connections
• When connecting to message brokers like RabbitMQ
• When authenticating with OIDC or OAuth2 providers
• At any point when the configured datasource or service attempts to authenticate

These runtime failures can cause:

• Service outages if the issue reaches production
• Failed database connections preventing application functionality
• Authentication errors that may be misattributed to credential validity rather than provider availability
• Debugging complexity due to the indirect nature of the failure

How to fix it

Add the @Unremovable annotation to your custom CredentialsProvider implementation. This annotation must be imported from io.quarkus.arc.Unremovable and placed alongside your CDI scope annotation (typically @ApplicationScoped).

Code examples

Noncompliant code example

@ApplicationScoped
public class MyCredentialsProvider implements CredentialsProvider { // Noncompliant

    @Override
    public Map<String, String> getCredentials(String credentialsProviderName) {
        Map<String, String> properties = new HashMap<>();
        properties.put(USER_PROPERTY_NAME, "user");
        properties.put(PASSWORD_PROPERTY_NAME, "password");
        return properties;
    }
}

Compliant solution

@ApplicationScoped
@Unremovable
public class MyCredentialsProvider implements CredentialsProvider {

    @Override
    public Map<String, String> getCredentials(String credentialsProviderName) {
        Map<String, String> properties = new HashMap<>();
        properties.put(USER_PROPERTY_NAME, "user");
        properties.put(PASSWORD_PROPERTY_NAME, "password");
        return properties;
    }
}

Resources

Documentation

• Quarkus Guide - Using a Credentials Provider
• Quarkus Guide - Removing Unused Beans