{"record":{"id":"dcc323f3e17d53a2","repo":"quarkusio/quarkus","slug":"unsupported-authentication-mechanism","errorCode":null,"errorMessage":"Unsupported authentication mechanism ","messagePattern":"Unsupported authentication mechanism ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClients.java","lineNumber":557,"sourceCode":"        String username = usernamePassword.username();\n        char[] password = usernamePassword.password();\n        MongoCredential credential;\n        if (mechanism == GSSAPI) {\n            credential = MongoCredential.createGSSAPICredential(username);\n        } else if (mechanism == PLAIN) {\n            credential = MongoCredential.createPlainCredential(username, authSource, password);\n        } else if (mechanism == MONGODB_X509) {\n            credential = MongoCredential.createMongoX509Credential(username);\n        } else if (mechanism == SCRAM_SHA_1) {\n            credential = MongoCredential.createScramSha1Credential(username, authSource, password);\n        } else if (mechanism == SCRAM_SHA_256) {\n            credential = MongoCredential.createScramSha256Credential(username, authSource, password);\n        } else if (mechanism == MONGODB_AWS) {\n            credential = MongoCredential.createAwsCredential(username, password);\n        } else if (mechanism == null) {\n            credential = MongoCredential.createCredential(username, authSource, password);\n        } else {\n            throw new IllegalArgumentException(\"Unsupported authentication mechanism \" + mechanism);\n        }\n\n        //add the properties\n        if (!config.credentials().authMechanismProperties().isEmpty()) {\n            for (Map.Entry<String, String> entry : config.credentials().authMechanismProperties().entrySet()) {\n                credential = credential.withMechanismProperty(entry.getKey(), entry.getValue());\n            }\n        }\n\n        return credential;\n    }\n\n    private UsernamePassword determineUserNamePassword(CredentialConfig config) {\n        if (config.credentialsProvider().isPresent()) {\n            String beanName = config.credentialsProviderName().orElse(null);\n            CredentialsProvider credentialsProvider = CredentialsProviderFinder.find(beanName);\n            String name = config.credentialsProvider().get();\n            Map<String, String> credentials = credentialsProvider.getCredentialsAsync(name).await().indefinitely();","sourceCodeStart":539,"sourceCodeEnd":575,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClients.java#L539-L575","documentation":"After mapping the configured mechanism name to a driver AuthenticationMechanism, Quarkus only supports SCRAM-SHA-1, SCRAM-SHA-256, MONGODB-AWS, GSSAPI, MONGODB-X509 (handled above) and the default null. Any other mapped mechanism value reaches this fall-through and throws IllegalArgumentException.","triggerScenarios":"`quarkus.mongodb.credentials.auth-mechanism` set to a value that maps to a mechanism the Quarkus wiring does not handle (e.g. PLAIN, MONGODB-CR) rather than one of the supported branches.","commonSituations":"Legacy MONGODB-CR deployments using old config values; PLAIN (LDAP) authentication copied from old driver examples; typos that still resolve via fromMechanismName but aren't wired by Quarkus.","solutions":["Use SCRAM-SHA-256 (default for MongoDB 4.0+) or SCRAM-SHA-1: set auth-mechanism=SCRAM-SHA-256","For AWS IAM auth use MONGODB-AWS with session credentials","For LDAP use a supported path or connect via a driver-supported mechanism not requiring Quarkus's credential branch; remove unsupported auth-mechanism and let the driver default (null branch) negotiate","Verify the exact mechanism value against the configured MongoDB server version"],"exampleFix":"// before\nquarkus.mongodb.credentials.auth-mechanism=PLAIN\n// after\nquarkus.mongodb.credentials.auth-mechanism=SCRAM-SHA-256","handlingStrategy":"validation","validationCode":"Set<String> supported = Set.of(\"SCRAM-SHA-1\", \"SCRAM-SHA-256\", \"MONGODB-X509\", \"GSSAPI\", \"MONGODB-AWS\");\nString mech = config.credentials().authMechanism();\nif (mech != null && !supported.contains(mech.toUpperCase())) {\n    throw new ConfigurationException(\"auth-mechanism must be one of \" + supported + \", got: \" + mech);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Stick to SCRAM-SHA-256 unless the server requires otherwise","Confirm the mechanism against the MongoDB server version in use","Avoid legacy MONGODB-CR/PLAIN unless explicitly supported by your Quarkus version"],"tags":["mongodb","authentication","configuration"],"backgroundTag":"unsupported-auth-mechanism","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}