{"record":{"id":"5df4b759ee595258","repo":"quarkusio/quarkus","slug":"failed-to-get-user-principal","errorCode":null,"errorMessage":"Failed to get user principal","messagePattern":"Failed to get user principal","errorType":"http","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java","lineNumber":38,"sourceCode":"import io.quarkus.security.PermissionsAllowed;\nimport io.quarkus.security.identity.SecurityIdentity;\nimport io.quarkus.vertx.http.runtime.security.HttpSecurityUtils;\n\n@Path(\"/\")\npublic class RootResource {\n    @Inject\n    SecurityIdentity identity;\n    @Inject\n    Principal principal;\n\n    @POST\n    @Consumes(MediaType.TEXT_PLAIN)\n    public String posts(String data, @Context SecurityContext sec) {\n        if (data == null) {\n            throw new RuntimeException(\"No post data\");\n        }\n        if (sec.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"Failed to get user principal\");\n        }\n        return \"post success\";\n    }\n\n    @GET\n    @Produces(MediaType.TEXT_PLAIN)\n    public String approval(@Context SecurityContext sec) {\n        if (sec.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"Failed to get user principal\");\n        }\n        return \"get success\";\n    }\n\n    @GET\n    @Path(\"/secure\")\n    @Authenticated\n    public String getSecure() {\n        return \"secure\";","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java#L20-L56","documentation":"Thrown by RootResource.posts when sec.getUserPrincipal() returns a Principal whose name is null — i.e. the Elytron security context did not authenticate the caller as expected. This signals an authentication/authorization wiring problem rather than bad input.","triggerScenarios":"POSTing valid data without valid credentials (401 handled elsewhere), anonymous access allowed by config so the Principal is anonymous/unnamed, or a missing/incorrectly configured Elytron identity realm.","commonSituations":"Missing quarkus.http.auth.* / elytron identity configuration; wrong Basic auth credentials in the client; security disabled in dev so an anonymous principal is injected.","solutions":["Send valid authentication credentials (e.g. Basic auth for a configured Elytron user).","Verify quarkus-elytron-security / properties-file identity config defines the user (quarkus.security.users.* or elytron config).","Ensure the endpoint requires authentication (quarkus.http.auth.permission policies) so anonymous requests never reach the method."],"exampleFix":"// before\ncurl -X POST -H 'Content-Type: text/plain' -d 'hello' http://localhost:8080/rest-elytron\n// after\ncurl -X POST -u alice:alice -H 'Content-Type: text/plain' -d 'hello' http://localhost:8080/rest-elytron","handlingStrategy":"validation","validationCode":"// verify credentials configured before calling the secured endpoint\nif (username == null || password == null) {\n    throw new IllegalStateException(\"Credentials required for secured POST\");\n}","typeGuard":"boolean isAuthenticated(javax.ws.rs.core.SecurityContext sec) {\n    return sec != null && sec.getUserPrincipal() != null && sec.getUserPrincipal().getName() != null;\n}","tryCatchPattern":"try {\n    String resp = target.request().post(Entity.text(data));\n} catch (javax.ws.rs.NotAuthorizedException e) {\n    log.error(\"Provide valid Basic auth credentials\");\n}","preventionTips":["Configure Elytron users/roles before hitting secured endpoints.","Send Basic auth (or the configured auth scheme) with every request.","Require authentication via quarkus.http.auth.permission policies so anonymous requests are rejected early.","Verify the deployed user exists in the identity store (properties file or realm)."],"tags":["elytron","security","authentication"],"backgroundTag":"missing-user-principal","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}