What causes "Could not obtain credential" in quarkusio/quarkus?

Inspect the cause of the RuntimeException (it wraps the original exception) to find the real failure.

quarkusio/quarkus · error · RuntimeException

Could not obtain credential

Error message

Could not obtain credential

What it means

QuarkusDirContextFactory.obtainDirContext uses an Elytron CallbackHandler to collect the LDAP bind principal and password via NameCallback/PasswordCallback. If handler.handle(...) throws (or any exception occurs while obtaining the credentials), the method wraps it in a RuntimeException('Could not obtain credential'). This means the configured credential supplier could not provide the bind credentials, before any LDAP connection is even attempted.

Source

Thrown at extensions/elytron-security-ldap/runtime/src/main/java/io/quarkus/elytron/security/ldap/QuarkusDirContextFactory.java:59

    @Override
    public DirContext obtainDirContext(ReferralMode mode) throws NamingException {
        char[] charPassword = null;
        if (securityCredential != null) { // password from String
            charPassword = securityCredential.toCharArray();
        }
        return createDirContext(securityPrincipal, charPassword, mode);
    }

    @Override
    public DirContext obtainDirContext(CallbackHandler handler, ReferralMode mode) throws NamingException {
        NameCallback nameCallback = new NameCallback("Principal Name");
        PasswordCallback passwordCallback = new PasswordCallback("Password", false);

        try {
            handler.handle(new Callback[] { nameCallback, passwordCallback });
        } catch (Exception e) {
            throw new RuntimeException("Could not obtain credential", e);
            //            throw log.couldNotObtainCredentialWithCause(e);
        }

        String securityPrincipal = nameCallback.getName();

        if (securityPrincipal == null) {
            throw new RuntimeException("Could not obtain principal");
            //            throw log.couldNotObtainPrincipal();
        }

        char[] securityCredential = passwordCallback.getPassword();

        if (securityCredential == null) {
            throw new RuntimeException("Could not obtain credential");
            //            throw log.couldNotObtainCredential();
        }

        return createDirContext(securityPrincipal, securityCredential, mode);

View on GitHub (pinned to e1c734241f)

Solutions

Inspect the cause of the RuntimeException (it wraps the original exception) to find the real failure.
Verify the LDAP config (quarkus.elytron.security.ldap.*): the identity/credential supplying properties are set and correct.
If a custom CallbackHandler/credential supplier is registered, ensure it handles NameCallback and PasswordCallback without throwing.
Test the bind credentials directly against the LDAP server (e.g. ldapwhoami) to rule out credential problems.

Example fix

// before: handler that returns nothing and throws on NameCallback
callbackHandler = cfg -> { throw new IllegalStateException("not configured"); };
// after: provide both callbacks
bindingConfig.setCallbackHandler(callbacks -> {
    for (Callback cb : callbacks) {
        if (cb instanceof NameCallback) ((NameCallback) cb).setName(dn);
        if (cb instanceof PasswordCallback) ((PasswordCallback) cb).setPassword(pwd);
    }
});

Defensive patterns

Strategy: try-catch

Validate before calling

// verify LDAP bind configuration before touching DirContext
if (config.principal() == null || config.principal().isBlank()) {
    throw new IllegalStateException("LDAP bind principal not configured");
}
if (config.password() == null) {
    throw new IllegalStateException("LDAP bind password not configured");
}

Try / catch

try {
    DirContext ctx = dirContextFactory.obtainDirContext();
} catch (RuntimeException e) {
    if ("Could not obtain credential".equals(e.getMessage())) {
        throw new DeploymentException("LDAP credential supplier failed", e.getCause());
    }
    throw e;
}

Prevention

Inspect the wrapped cause — it names the real failing component.
Validate LDAP config properties at application startup.
Test bind credentials against the LDAP server out-of-band (ldapwhoami).
Keep custom CallbackHandler implementations simple and null-safe.

When it happens

Trigger: The CallbackHandler (typically a supplied credential supplier / properties-based handler) throws while handling the callbacks — e.g. the backing supplier throws SecurityException or the configured identity/credential supplier is missing or fails.

Common situations: quarkus.elytron.security.ldap directory context factory configured with a custom credential supplier that fails; missing configuration so the handler cannot resolve the bind principal/password; wrapped exception's cause shows the real error (missing config key, security exception).

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/95a1a7de052f2240. Report an issue: GitHub.