quarkusio/quarkus · error · AuthenticationFailedException

AuthenticationFailedException

Error message

AuthenticationFailedException

What it means

ElytronPasswordIdentityProvider.authenticate() throws AuthenticationFailedException when the security domain's authenticate(username, PasswordGuessEvidence) call returns null, meaning no realm in the domain could verify the supplied username/password. It is Quarkus's signal that the credentials were rejected (not that the realm was broken). Callers (HTTP auth mechanisms) translate it into a 401 response.

Source

Thrown at extensions/elytron-security/runtime/src/main/java/io/quarkus/elytron/security/runtime/ElytronPasswordIdentityProvider.java:53

    @Override
    public Class<UsernamePasswordAuthenticationRequest> getRequestType() {
        return UsernamePasswordAuthenticationRequest.class;
    }

    @Override
    public Uni<SecurityIdentity> authenticate(UsernamePasswordAuthenticationRequest request,
            AuthenticationRequestContext context) {
        return context.runBlocking(new Supplier<SecurityIdentity>() {
            @Override
            public SecurityIdentity get() {
                org.wildfly.security.auth.server.SecurityIdentity result;
                try {
                    result = domain.authenticate(request.getUsername(),
                            new PasswordGuessEvidence(request.getPassword().getPassword()));

                    if (result == null) {
                        throw new AuthenticationFailedException();
                    }
                    QuarkusSecurityIdentity.Builder builder = QuarkusSecurityIdentity.builder();
                    for (Attributes.Entry entry : result.getAttributes().entries()) {
                        builder.addAttribute(entry.getKey(), entry);
                    }

                    builder.setPrincipal(result.getPrincipal());
                    for (String i : result.getRoles()) {
                        builder.addRole(i);
                    }
                    builder.addCredential(request.getPassword());
                    return builder.build();
                } catch (RealmUnavailableException e) {
                    throw new RuntimeException(e);
                } catch (SecurityException e) {
                    log.debug("Authentication failed", e);
                    throw new AuthenticationFailedException(e);
                }

View on GitHub (pinned to e1c734241f)

Solutions

1. Verify the username exists in the configured realm and the password matches (check quarkus.security.users.embedded/users.properties or the realm config).
2. Confirm the realm's password algorithm/key matches how passwords were stored (e.g. bcrypt vs clear).
3. Check SecurityDomain realm configuration: the realm name used by the identity provider must match a realm registered in the domain.
4. Enable org.wildfly.security debug logging to see which realm rejected the evidence.

Example fix

// before: properties file user with clear password but realm expects bcrypt
alice=secret
// after (add to properties file via BcryptUtil or use clear-password realm config)
alice=$2a$10$...bcrypt.hash...

// verify the user exists in the configured realm/user store before attempting auth
boolean knownUser = userStore.contains(request.getUsername());
if (!knownUser) { return fail401(); }

try {
    SecurityIdentity id = identityProvider.authenticate(request);
} catch (AuthenticationFailedException e) {
    // reject credentials, return 401, do not retry with same credentials
    return Response.status(401).build();
}

When it happens

Trigger: Calling AuthenticationRequest-based authentication where domain.authenticate(...) returns null: wrong password, unknown username, realm map fails to match any user, or the identity provider is invoked with credentials the configured security realm does not recognize.

Common situations: User typed wrong credentials; the properties/file/JDBC/LDAP realm doesn't contain the user; password stored with a different algorithm than the realm expects; identity provider wired against a domain whose realm names don't match the config (quarkus.security.users.* vs elytron domain config).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• AuthenticationFailedException
• AuthenticationFailedException
• Failed to get user principal

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/74cfa6c7c4c8c19f. Report an issue: GitHub.