{"record":{"id":"e6d1941bf6c7b8fe","repo":"quarkusio/quarkus","slug":"authenticationfailedexception-e6d194","errorCode":null,"errorMessage":"AuthenticationFailedException","messagePattern":"AuthenticationFailedException","errorType":"exception","errorClass":"AuthenticationFailedException","httpStatus":401,"severity":"error","filePath":"extensions/security-jpa/runtime/src/main/java/io/quarkus/security/jpa/runtime/JpaTrustedIdentityProvider.java","lineNumber":63,"sourceCode":"                    try {\n                        return authenticate(request);\n                    } finally {\n                        requestContext.terminate();\n                    }\n                }\n                return authenticate(request);\n            }\n        });\n    }\n\n    private SecurityIdentity authenticate(TrustedAuthenticationRequest request) {\n        try (Session session = sessionFactory.openSession()) {\n            session.setHibernateFlushMode(FlushMode.MANUAL);\n            session.setDefaultReadOnly(true);\n            return authenticate(session, request);\n        } catch (SecurityException e) {\n            log.debug(\"Authentication failed\", e);\n            throw new AuthenticationFailedException(e);\n        }\n    }\n\n    protected boolean requireActiveCDIRequestContext() {\n        return false;\n    }\n\n    protected <T> T getSingleUser(Query query) {\n        @SuppressWarnings(\"unchecked\")\n        List<T> results = (List<T>) query.getResultList();\n        return JpaIdentityProviderUtil.getSingleUser(results);\n    }\n\n    public abstract SecurityIdentity authenticate(EntityManager em,\n            TrustedAuthenticationRequest request);\n}\n","sourceCodeStart":45,"sourceCodeEnd":80,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-jpa/runtime/src/main/java/io/quarkus/security/jpa/runtime/JpaTrustedIdentityProvider.java#L45-L80","documentation":"JpaTrustedIdentityProvider.authenticate() opens a read-only Hibernate session and loads the user without password verification ('trusted' mode). SecurityExceptions during the lookup are wrapped in AuthenticationFailedException, leading to a 401 for the request.","triggerScenarios":"An authentication request handled by the trusted JPA provider where the session/user lookup throws SecurityException — e.g. username not found, entity mapping/query misconfiguration, or database failures wrapped as SecurityException.","commonSituations":"Using trusted authentication (e.g. behind a proxy/mTLS where the identity was already verified) but the username does not exist in the database; renamed user column; wrong persistence unit pointing to an empty schema.","solutions":["Enable debug logging for the provider to read the wrapped SecurityException cause.","Verify the incoming username exists in the user table of the configured persistence unit.","Check entity/table mappings (user definition entity, name column) and that the datasource points to the right database.","Ensure upstream (proxy, certificate) actually sends the expected authenticated principal name."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    SecurityIdentity id = provider.authenticate(request).await().indefinitely();\n} catch (AuthenticationFailedException e) {\n    log.debug(\"trusted auth failed\", e.getCause());\n    return 401;\n}","preventionTips":["Verify the principal name sent upstream exists in the user table","Check entity mappings/column names for the user definition","Confirm the datasource points to the intended schema"],"tags":["security","authentication","jpa","trusted-identity"],"backgroundTag":"authentication-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}