quarkusio/quarkus · error · AuthenticationFailedException

AuthenticationFailedException

Error message

AuthenticationFailedException

What it means

JpaIdentityProvider.authenticate() opens a read-only Hibernate session and delegates to authenticate(session, request). Any SecurityException raised while loading/validating the user (credential verification failure, lookup failure) is wrapped in an AuthenticationFailedException, which the HTTP auth machinery turns into a 401.

Source

Thrown at extensions/security-jpa/runtime/src/main/java/io/quarkus/security/jpa/runtime/JpaIdentityProvider.java:63

                    try {
                        return authenticate(request);
                    } finally {
                        requestContext.terminate();
                    }
                }
                return authenticate(request);
            }
        });
    }

    private SecurityIdentity authenticate(UsernamePasswordAuthenticationRequest request) {
        try (Session session = sessionFactory.openSession()) {
            session.setHibernateFlushMode(FlushMode.MANUAL);
            session.setDefaultReadOnly(true);
            return authenticate(session, request);
        } catch (SecurityException e) {
            log.debug("Authentication failed", e);
            throw new AuthenticationFailedException(e);
        }
    }

    protected <T> T getSingleUser(Query query) {
        @SuppressWarnings("unchecked")
        List<T> results = (List<T>) query.getResultList();
        return JpaIdentityProviderUtil.getSingleUser(results);
    }

    protected boolean requireActiveCDIRequestContext() {
        return false;
    }

    public abstract SecurityIdentity authenticate(EntityManager em,
            UsernamePasswordAuthenticationRequest request);

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Check server logs at debug level for the wrapped SecurityException ('Authentication failed') to find the root cause.
2. Verify the user's credentials and that the stored password hash matches the configured password type/provider (e.g. bcrypt vs clear).
3. Confirm the user exists and the user-definition entity mappings are correct.
4. If credentials are fine, inspect the session/DB connectivity and query configuration.

try {
    SecurityIdentity id = identityProviderManager.authenticate(request).await().indefinitely();
} catch (AuthenticationFailedException e) {
    log.debug("auth failed", e.getCause()); // inspect wrapped SecurityException
    return Response.status(401).build();
}

When it happens

Trigger: A login request against the JPA identity provider whose authenticate() throws SecurityException — e.g. stored-password verification failing or the user query failing validation.

Common situations: User typing wrong username/password; password hash algorithm mismatch between stored hash and configured PasswordProvider; custom JpaIdentityProvider subclass throwing SecurityException for business reasons; database errors surfaced as auth failures.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• AuthenticationFailedException
• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• You must override this method or IdentityProvider.authentica
• You must override this method or IdentityProvider.authentica

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0678c4446ff2fa8c. Report an issue: GitHub.