{"record":{"id":"105b1fc6988b0d03","repo":"quarkusio/quarkus","slug":"unknown-password-type-passwordtype","errorCode":null,"errorMessage":"Unknown password type: ${passwordType}","messagePattern":"Unknown password type: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security-jpa-common/deployment/src/main/java/io/quarkus/security/jpa/common/deployment/JpaSecurityIdentityUtil.java","lineNumber":97,"sourceCode":"                LocalVar objectToInvokeOn = bc.localVar(\"ppObj\",\n                        bc.get(thisRef.field(passwordProviderField)));\n\n                // :getPasswordMethod(:pass);\n                storedPassword = bc.invokeVirtual(\n                        ClassMethodDesc.of(ClassDesc.of(passwordProviderClassStr),\n                                passwordProviderMethod,\n                                Password.class,\n                                String.class),\n                        bc.cast(objectToInvokeOn, ClassDesc.of(passwordProviderClassStr)), pass);\n                break;\n            case CLEAR:\n                storedPassword = bc.invokeStatic(getUtilMethod(\"getClearPassword\"), pass);\n                break;\n            case MCF:\n                storedPassword = bc.invokeStatic(getUtilMethod(\"getMcfPassword\"), pass);\n                break;\n            default:\n                throw new RuntimeException(\"Unknown password type: \" + passwordType);\n        }\n\n        // Builder builder = JpaIdentityProviderUtil.checkPassword(storedPassword, request);\n        Expr builder = bc.invokeStatic(\n                MethodDesc.of(JpaIdentityProviderUtil.class, \"checkPassword\",\n                        QuarkusSecurityIdentity.Builder.class,\n                        Password.class,\n                        UsernamePasswordAuthenticationRequest.class),\n                storedPassword, requestParam);\n        LocalVar builderVar = bc.localVar(\"builder\", QuarkusSecurityIdentity.Builder.class, builder);\n\n        setupRoles(index, jpaSecurityDefinition, panacheEntityPredicate, userVar, builderVar, bc);\n    }\n\n    public static void buildTrustedIdentity(Index index, JpaSecurityDefinition jpaSecurityDefinition,\n            PanacheEntityPredicateBuildItem panacheEntityPredicate, Expr requestParam, Expr userVar,\n            BlockCreator bc) {\n        // if(user == null) return null;","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-jpa-common/deployment/src/main/java/io/quarkus/security/jpa/common/deployment/JpaSecurityIdentityUtil.java#L79-L115","documentation":"During build-time bytecode generation of the JPA identity provider, the @PasswordProvider/PasswordType enum value from @UserDefinition is switched over. Only CUSTOM, CLEAR, and MCF are implemented; any other PasswordType falls into the default branch and fails the build. This is a deployment (build-time) failure, not a runtime exception.","triggerScenarios":"Annotating a @UserDefinition entity field with @Password(type=...) whose PasswordType enum value is not CUSTOM, CLEAR, or MCF. In practice the switch is exhausted, so this fires only if a new enum constant is added to PasswordType without updating this generator, or via bytecode-generation edge cases.","commonSituations":"Developing against a newer/older Quarkus version where PasswordType gained constants (e.g. SALTED) that this deployment code does not handle; custom forks of PasswordType; copy-pasted annotation values from another extension.","solutions":["Set @Password(type = PasswordType.CLEAR), PasswordType.MCF, or PasswordType.CUSTOM (with @PasswordProvider) in your @UserDefinition entity.","If a custom type is needed, use PasswordType.CUSTOM and supply a class implementing the password provider via @PasswordProvider.","If you added a new PasswordType constant, extend the switch in JpaSecurityIdentityUtil.buildIdentity to handle it.","Align your Quarkus version with the PasswordType enum available in that release."],"exampleFix":"// before\n@Password(type = PasswordType.SALTED)\npublic String password;\n\n// after\n@Password(type = PasswordType.MCF)\npublic String password;","handlingStrategy":"validation","validationCode":"PasswordType t = userClass.getAnnotation(Password.class) != null\n        ? userClass.getAnnotation(Password.class).type() : PasswordType.MCF;\nif (t != PasswordType.CLEAR && t != PasswordType.MCF && t != PasswordType.CUSTOM)\n    throw new IllegalArgumentException(\"Unsupported PasswordType: \" + t);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use CLEAR, MCF, or CUSTOM (+ @PasswordProvider) in @Password annotations.","Prefer MCF for hashed passwords (bcrypt/argon2 strings).","If extending PasswordType, update JpaSecurityIdentityUtil.buildIdentity in the same change."],"tags":["quarkus","security-jpa","build-time","config"],"backgroundTag":"unsupported-enum-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}