quarkusio/quarkus · error · AuthenticationFailedException

AuthenticationFailedException

Error message

AuthenticationFailedException

What it means

JpaTrustedIdentityProvider.authenticate() opens a read-only Hibernate session and loads the user without password verification ('trusted' mode). SecurityExceptions during the lookup are wrapped in AuthenticationFailedException, leading to a 401 for the request.

Source

Thrown at extensions/security-jpa/runtime/src/main/java/io/quarkus/security/jpa/runtime/JpaTrustedIdentityProvider.java:63

                    try {
                        return authenticate(request);
                    } finally {
                        requestContext.terminate();
                    }
                }
                return authenticate(request);
            }
        });
    }

    private SecurityIdentity authenticate(TrustedAuthenticationRequest request) {
        try (Session session = sessionFactory.openSession()) {
            session.setHibernateFlushMode(FlushMode.MANUAL);
            session.setDefaultReadOnly(true);
            return authenticate(session, request);
        } catch (SecurityException e) {
            log.debug("Authentication failed", e);
            throw new AuthenticationFailedException(e);
        }
    }

    protected boolean requireActiveCDIRequestContext() {
        return false;
    }

    protected <T> T getSingleUser(Query query) {
        @SuppressWarnings("unchecked")
        List<T> results = (List<T>) query.getResultList();
        return JpaIdentityProviderUtil.getSingleUser(results);
    }

    public abstract SecurityIdentity authenticate(EntityManager em,
            TrustedAuthenticationRequest request);
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Enable debug logging for the provider to read the wrapped SecurityException cause.
2. Verify the incoming username exists in the user table of the configured persistence unit.
3. Check entity/table mappings (user definition entity, name column) and that the datasource points to the right database.
4. Ensure upstream (proxy, certificate) actually sends the expected authenticated principal name.

try {
    SecurityIdentity id = provider.authenticate(request).await().indefinitely();
} catch (AuthenticationFailedException e) {
    log.debug("trusted auth failed", e.getCause());
    return 401;
}

When it happens

Trigger: An authentication request handled by the trusted JPA provider where the session/user lookup throws SecurityException — e.g. username not found, entity mapping/query misconfiguration, or database failures wrapped as SecurityException.

Common situations: Using trusted authentication (e.g. behind a proxy/mTLS where the identity was already verified) but the username does not exist in the database; renamed user column; wrong persistence unit pointing to an empty schema.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• AuthenticationFailedException
• AuthenticationFailedException
• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• You must override this method or IdentityProvider.authentica

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e6d1941bf6c7b8fe. Report an issue: GitHub.