{"record":{"id":"74a8617a056bdce3","repo":"quarkusio/quarkus","slug":"failed-to-get-user-principal-74a861","errorCode":null,"errorMessage":"Failed to get user principal","messagePattern":"Failed to get user principal","errorType":"http","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/elytron-resteasy-reactive/src/main/java/io/quarkus/it/resteasy/reactive/elytron/RootResource.java","lineNumber":33,"sourceCode":"import jakarta.ws.rs.core.SecurityContext;\n\nimport io.quarkus.security.Authenticated;\nimport io.quarkus.security.PermissionsAllowed;\nimport io.quarkus.security.identity.SecurityIdentity;\n\n@Path(\"/\")\npublic class RootResource {\n    @Inject\n    SecurityIdentity identity;\n\n    @POST\n    @Consumes(MediaType.TEXT_PLAIN)\n    public String posts(String data, @Context SecurityContext sec) {\n        if (data == null) {\n            throw new RuntimeException(\"No post data\");\n        }\n        if (sec.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"Failed to get user principal\");\n        }\n        return \"post success\";\n    }\n\n    @GET\n    @Produces(MediaType.TEXT_PLAIN)\n    public String approval(@Context SecurityContext sec) {\n        if (sec.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"Failed to get user principal\");\n        }\n        return \"get success\";\n    }\n\n    @GET\n    @Path(\"/secure\")\n    @Authenticated\n    public String getSecure() {\n        return \"secure\";","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/elytron-resteasy-reactive/src/main/java/io/quarkus/it/resteasy/reactive/elytron/RootResource.java#L15-L51","documentation":"Sentinel RuntimeException thrown by RootResource.posts() when SecurityContext.getUserPrincipal().getName() is null on the POST path. It indicates the request was not associated with an authenticated principal despite the endpoint expecting one under Elytron security in RESTEasy Reactive.","triggerScenarios":"POST with text body but no valid authentication, so sec.getUserPrincipal() yields a principal with null name (or anonymous identity).","commonSituations":"Missing Authorization header; wrong credentials; security not activated for the reactive runtime; test client forgetting basic auth after switching from classic RESTEasy to reactive.","solutions":["Attach valid Basic Auth credentials to the POST request","Verify the Elytron reactive security extension is configured (realm, users, roles in application.properties)","Confirm the POST path is not accidentally exempted from authentication by a permission/policy rule","Check identity propagation from the HTTP layer into the JAX-RS SecurityContext"],"exampleFix":"// before\ncurl -X POST http://localhost:8080/api -d 'hello'\n// after\ncurl -u admin:admin -X POST http://localhost:8080/api -d 'hello'","handlingStrategy":"validation","validationCode":"Principal p = sec.getUserPrincipal();\nif (p == null || p.getName() == null) {\n    throw new NotAuthorizedException(\"No authenticated principal\");\n}\nif (data == null || data.isBlank()) {\n    throw new BadRequestException(\"Body required\");\n}","typeGuard":"boolean authenticatedWithBody(String data, SecurityContext sec) {\n    return hasBody(data) && sec != null && sec.getUserPrincipal() != null && sec.getUserPrincipal().getName() != null;\n}","tryCatchPattern":"try {\n    return handle(data, sec);\n} catch (RuntimeException e) {\n    throw new InternalServerErrorException(\"POST handling failed\", e);\n}","preventionTips":["Combine body and principal validation at the top of the endpoint","Include basic-auth credentials in all POST test requests","Assert authentication works in both classic and reactive runtimes"],"tags":["security","elytron","resteasy-reactive","user-principal"],"backgroundTag":"user-principal-null","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}