quarkusio/quarkus · error · AuthenticationFailedException

AuthenticationFailedException

Error message

AuthenticationFailedException

What it means

ElytronTrustedIdentityProvider throws AuthenticationFailedException when the trusted identity run-as authorization completes but ServerAuthenticationContext.getAuthorizedIdentity() returns null (or the flow yields no identity). Trusted authentication works by adding private credentials to a ServerAuthenticationContext, calling authorize(), then getting the authorized identity — null means the trusted credential produced no usable identity.

Source

Thrown at extensions/elytron-security/runtime/src/main/java/io/quarkus/elytron/security/runtime/ElytronTrustedIdentityProvider.java:63

            @Override
            public SecurityIdentity get() {
                org.wildfly.security.auth.server.SecurityIdentity result;
                try {
                    RealmIdentity id = domain.getIdentity(request.getPrincipal());
                    if (!id.exists()) {
                        return null;
                    }
                    PasswordCredential cred = id.getCredential(PasswordCredential.class);
                    try (ServerAuthenticationContext ac = domain.createNewAuthenticationContext()) {
                        ac.setAuthenticationName(request.getPrincipal());
                        if (cred != null) {
                            ac.addPrivateCredential(cred);
                        }
                        ac.authorize();
                        result = ac.getAuthorizedIdentity();

                        if (result == null) {
                            throw new AuthenticationFailedException();
                        }
                        QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();
                        for (Attributes.Entry entry : result.getAttributes().entries()) {
                            builder.addAttribute(entry.getKey(), entry);
                        }
                        builder.setPrincipal(result.getPrincipal());
                        for (String i : result.getRoles()) {
                            builder.addRole(i);
                        }
                        return builder.build();
                    }
                } catch (RealmUnavailableException e) {
                    throw new RuntimeException(e);
                } catch (SecurityException e) {
                    log.debug("Authentication failed", e);
                    throw new AuthenticationFailedException(e);
                }
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Confirm the realm supports the trusted credential type (e.g. X509 evidence) and is registered in the SecurityDomain.
2. Check that the trust store / certificate configuration actually contains the presented credential's issuer.
3. Enable Elytron debug logging on the ServerAuthenticationContext to see why authorize() yields no identity.
4. Verify realm names in the trusted identity provider config match the domain's realms.

Example fix

// before: sending a plain username as trusted credential to a cert realm
ac.addPrivateCredential(username);
// after: supply the supported evidence type, e.g. certificate evidence
ac.addPrivateCredential(certificateX509);
ac.addPrivateCredential(new X509PeerCertificateChainEvidence(chain));

// ensure the trusted credential type is supported before attempting trusted auth
boolean supported = supportedTrustedCredentialTypes.contains(cred.getClass());
if (!supported) { skipTrustedAuth(); }

boolean isTrustedCredential(Object c) {
    return c instanceof X509Certificate || c instanceof X509PeerCertificateChainEvidence;
}

When it happens

Trigger: AuthenticationRequest with trusted credentials where ac.authorize() does not yield an identity: the trusted credential is not accepted by the realm, the name/evidence maps to no principal, or authorization completes with an unauthenticated result.

Common situations: Client certificate / trusted-header credentials presented to a realm that doesn't support them; security domain realm mismatch so the trusted credential can't be resolved; certificate not in the trust store.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• AuthenticationFailedException
• AuthenticationFailedException
• AuthenticationFailedException

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/6f6852e671ad49a9. Report an issue: GitHub.