{"record":{"id":"74cfa6c7c4c8c19f","repo":"quarkusio/quarkus","slug":"authenticationfailedexception","errorCode":null,"errorMessage":"AuthenticationFailedException","messagePattern":"AuthenticationFailedException","errorType":"http","errorClass":"AuthenticationFailedException","httpStatus":401,"severity":"error","filePath":"extensions/elytron-security/runtime/src/main/java/io/quarkus/elytron/security/runtime/ElytronPasswordIdentityProvider.java","lineNumber":53,"sourceCode":"\n    @Override\n    public Class<UsernamePasswordAuthenticationRequest> getRequestType() {\n        return UsernamePasswordAuthenticationRequest.class;\n    }\n\n    @Override\n    public Uni<SecurityIdentity> authenticate(UsernamePasswordAuthenticationRequest request,\n            AuthenticationRequestContext context) {\n        return context.runBlocking(new Supplier<SecurityIdentity>() {\n            @Override\n            public SecurityIdentity get() {\n                org.wildfly.security.auth.server.SecurityIdentity result;\n                try {\n                    result = domain.authenticate(request.getUsername(),\n                            new PasswordGuessEvidence(request.getPassword().getPassword()));\n\n                    if (result == null) {\n                        throw new AuthenticationFailedException();\n                    }\n                    QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();\n                    for (Attributes.Entry entry : result.getAttributes().entries()) {\n                        builder.addAttribute(entry.getKey(), entry);\n                    }\n\n                    builder.setPrincipal(result.getPrincipal());\n                    for (String i : result.getRoles()) {\n                        builder.addRole(i);\n                    }\n                    builder.addCredential(request.getPassword());\n                    return builder.build();\n                } catch (RealmUnavailableException e) {\n                    throw new RuntimeException(e);\n                } catch (SecurityException e) {\n                    log.debug(\"Authentication failed\", e);\n                    throw new AuthenticationFailedException(e);\n                }","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/elytron-security/runtime/src/main/java/io/quarkus/elytron/security/runtime/ElytronPasswordIdentityProvider.java#L35-L71","documentation":"ElytronPasswordIdentityProvider.authenticate() throws AuthenticationFailedException when the security domain's authenticate(username, PasswordGuessEvidence) call returns null, meaning no realm in the domain could verify the supplied username/password. It is Quarkus's signal that the credentials were rejected (not that the realm was broken). Callers (HTTP auth mechanisms) translate it into a 401 response.","triggerScenarios":"Calling AuthenticationRequest-based authentication where domain.authenticate(...) returns null: wrong password, unknown username, realm map fails to match any user, or the identity provider is invoked with credentials the configured security realm does not recognize.","commonSituations":"User typed wrong credentials; the properties/file/JDBC/LDAP realm doesn't contain the user; password stored with a different algorithm than the realm expects; identity provider wired against a domain whose realm names don't match the config (quarkus.security.users.* vs elytron domain config).","solutions":["Verify the username exists in the configured realm and the password matches (check quarkus.security.users.embedded/users.properties or the realm config).","Confirm the realm's password algorithm/key matches how passwords were stored (e.g. bcrypt vs clear).","Check SecurityDomain realm configuration: the realm name used by the identity provider must match a realm registered in the domain.","Enable org.wildfly.security debug logging to see which realm rejected the evidence."],"exampleFix":"// before: properties file user with clear password but realm expects bcrypt\nalice=secret\n// after (add to properties file via BcryptUtil or use clear-password realm config)\nalice=$2a$10$...bcrypt.hash...","handlingStrategy":"try-catch","validationCode":"// verify the user exists in the configured realm/user store before attempting auth\nboolean knownUser = userStore.contains(request.getUsername());\nif (!knownUser) { return fail401(); }","typeGuard":null,"tryCatchPattern":"try {\n    SecurityIdentity id = identityProvider.authenticate(request);\n} catch (AuthenticationFailedException e) {\n    // reject credentials, return 401, do not retry with same credentials\n    return Response.status(401).build();\n}","preventionTips":["Keep user store and realm configuration in sync (algorithms, realm names).","Log failed authentications at debug to diagnose quickly.","Add integration tests covering both bad-username and bad-password paths.","Never expose whether the username or the password was wrong to end users."],"tags":["security","authentication","elytron"],"backgroundTag":"authentication-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}