{"record":{"id":"6f6852e671ad49a9","repo":"quarkusio/quarkus","slug":"authenticationfailedexception-6f6852","errorCode":null,"errorMessage":"AuthenticationFailedException","messagePattern":"AuthenticationFailedException","errorType":"http","errorClass":"AuthenticationFailedException","httpStatus":401,"severity":"error","filePath":"extensions/elytron-security/runtime/src/main/java/io/quarkus/elytron/security/runtime/ElytronTrustedIdentityProvider.java","lineNumber":63,"sourceCode":"            @Override\n            public SecurityIdentity get() {\n                org.wildfly.security.auth.server.SecurityIdentity result;\n                try {\n                    RealmIdentity id = domain.getIdentity(request.getPrincipal());\n                    if (!id.exists()) {\n                        return null;\n                    }\n                    PasswordCredential cred = id.getCredential(PasswordCredential.class);\n                    try (ServerAuthenticationContext ac = domain.createNewAuthenticationContext()) {\n                        ac.setAuthenticationName(request.getPrincipal());\n                        if (cred != null) {\n                            ac.addPrivateCredential(cred);\n                        }\n                        ac.authorize();\n                        result = ac.getAuthorizedIdentity();\n\n                        if (result == null) {\n                            throw new AuthenticationFailedException();\n                        }\n                        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();\n                        for (Attributes.Entry entry : result.getAttributes().entries()) {\n                            builder.addAttribute(entry.getKey(), entry);\n                        }\n                        builder.setPrincipal(result.getPrincipal());\n                        for (String i : result.getRoles()) {\n                            builder.addRole(i);\n                        }\n                        return builder.build();\n                    }\n                } catch (RealmUnavailableException e) {\n                    throw new RuntimeException(e);\n                } catch (SecurityException e) {\n                    log.debug(\"Authentication failed\", e);\n                    throw new AuthenticationFailedException(e);\n                }\n            }","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/elytron-security/runtime/src/main/java/io/quarkus/elytron/security/runtime/ElytronTrustedIdentityProvider.java#L45-L81","documentation":"ElytronTrustedIdentityProvider throws AuthenticationFailedException when the trusted identity run-as authorization completes but ServerAuthenticationContext.getAuthorizedIdentity() returns null (or the flow yields no identity). Trusted authentication works by adding private credentials to a ServerAuthenticationContext, calling authorize(), then getting the authorized identity — null means the trusted credential produced no usable identity.","triggerScenarios":"AuthenticationRequest with trusted credentials where ac.authorize() does not yield an identity: the trusted credential is not accepted by the realm, the name/evidence maps to no principal, or authorization completes with an unauthenticated result.","commonSituations":"Client certificate / trusted-header credentials presented to a realm that doesn't support them; security domain realm mismatch so the trusted credential can't be resolved; certificate not in the trust store.","solutions":["Confirm the realm supports the trusted credential type (e.g. X509 evidence) and is registered in the SecurityDomain.","Check that the trust store / certificate configuration actually contains the presented credential's issuer.","Enable Elytron debug logging on the ServerAuthenticationContext to see why authorize() yields no identity.","Verify realm names in the trusted identity provider config match the domain's realms."],"exampleFix":"// before: sending a plain username as trusted credential to a cert realm\nac.addPrivateCredential(username);\n// after: supply the supported evidence type, e.g. certificate evidence\nac.addPrivateCredential(certificateX509);\nac.addPrivateCredential(new X509PeerCertificateChainEvidence(chain));","handlingStrategy":"validation","validationCode":"// ensure the trusted credential type is supported before attempting trusted auth\nboolean supported = supportedTrustedCredentialTypes.contains(cred.getClass());\nif (!supported) { skipTrustedAuth(); }","typeGuard":"boolean isTrustedCredential(Object c) {\n    return c instanceof X509Certificate || c instanceof X509PeerCertificateChainEvidence;\n}","tryCatchPattern":null,"preventionTips":["Register only realms that actually support your trusted credential type.","Keep trust stores updated and verify issuer chains before auth.","Match realm names between the trusted provider config and the domain.","Enable Elytron audit/logging in staging to catch null-identity flows early."],"tags":["security","authentication","elytron","trusted-identity"],"backgroundTag":"authentication-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}