{"record":{"id":"ffd906169bf5e81f","repo":"quarkusio/quarkus","slug":"authenticationfailedexception-ffd906","errorCode":null,"errorMessage":"AuthenticationFailedException","messagePattern":"AuthenticationFailedException","errorType":"exception","errorClass":"AuthenticationFailedException","httpStatus":401,"severity":"error","filePath":"extensions/security-jpa-common/runtime/src/main/java/io/quarkus/security/jpa/common/runtime/JpaIdentityProviderUtil.java","lineNumber":33,"sourceCode":"import io.quarkus.security.AuthenticationFailedException;\nimport io.quarkus.security.identity.request.TrustedAuthenticationRequest;\nimport io.quarkus.security.identity.request.UsernamePasswordAuthenticationRequest;\nimport io.quarkus.security.jpa.PasswordType;\nimport io.quarkus.security.runtime.QuarkusPrincipal;\nimport io.quarkus.security.runtime.QuarkusSecurityIdentity;\n\npublic class JpaIdentityProviderUtil {\n\n    private JpaIdentityProviderUtil() {\n        // utility class used by generated classes\n    }\n\n    public static QuarkusSecurityIdentity.Builder checkPassword(Password storedPassword,\n            UsernamePasswordAuthenticationRequest request) {\n        PasswordGuessEvidence sentPasswordEvidence = new PasswordGuessEvidence(request.getPassword().getPassword());\n        PasswordCredential storedPasswordCredential = new PasswordCredential(storedPassword);\n        if (!storedPasswordCredential.verify(ProviderUtil.INSTALLED_PROVIDERS, sentPasswordEvidence)) {\n            throw new AuthenticationFailedException();\n        }\n        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();\n        builder.setPrincipal(new QuarkusPrincipal(request.getUsername()));\n        builder.addCredential(request.getPassword());\n        return builder;\n    }\n\n    public static QuarkusSecurityIdentity.Builder trusted(TrustedAuthenticationRequest request) {\n        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();\n        builder.setPrincipal(new QuarkusPrincipal(request.getPrincipal()));\n        return builder;\n    }\n\n    public static void addRoles(QuarkusSecurityIdentity.Builder builder, String roles) {\n        if (roles.indexOf(',') != -1) {\n            for (String role : roles.split(\",\")) {\n                builder.addRole(role.trim());\n            }","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-jpa-common/runtime/src/main/java/io/quarkus/security/jpa/common/runtime/JpaIdentityProviderUtil.java#L15-L51","documentation":"JpaIdentityProviderUtil.checkPassword verifies the submitted password against the stored Password credential using Elytron's PasswordCredential.verify. When verification fails (wrong password, corrupted stored hash, or missing verifier for the algorithm), it throws AuthenticationFailedException, which Quarkus translates into a 401 response.","triggerScenarios":"A UsernamePasswordAuthenticationRequest is processed and PasswordCredential.verify(ProviderUtil.INSTALLED_PROVIDERS, sentPasswordEvidence) returns false — i.e. the supplied password does not match the stored CLEAR/MCF/custom-provided Password.","commonSituations":"User typing a wrong password; stored hash created with different parameters or a different algorithm; the password column holding a plain value while PasswordType.MCF is configured (or vice versa); provider not installed for custom password algorithms.","solutions":["Verify the user is submitting the correct username/password.","Confirm @Password(type=...) matches how the password is actually stored (plain text vs MCF string like bcrypt/argon2).","Re-store or reset the password so it is encoded consistently with the configured PasswordType.","For CUSTOM types, ensure the password provider's getPassword returns a Password the installed Elytron providers can verify."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// pre-check stored format matches configured type, e.g. for MCF:\nif (passwordType == PasswordType.MCF && !stored.startsWith(\"$\"))\n    log.warn(\"Stored password is not an MCF string; checkPassword will fail\");","typeGuard":null,"tryCatchPattern":"try {\n    securityIdentity = identityProvider.authenticate(request).await().indefinitely();\n} catch (AuthenticationFailedException e) {\n    // return 401 / prompt retry; do not leak whether user exists\n    return Uni.createFrom().item(HttpCredentialTransport.ChallengeKind.HEADER_AUTZ);\n}","preventionTips":["Match @Password type to actual storage format (plain vs MCF).","Encode passwords with the same algorithm/parameters used at verification.","For CUSTOM types, register needed Elytron providers.","Never store/reset a password in a different format than configured."],"tags":["quarkus","security-jpa","authentication","password"],"backgroundTag":"authentication-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}