quarkusio/quarkus · error · RuntimeException

Could not obtain principal

Error message

Could not obtain principal

What it means

After handling the callbacks in QuarkusDirContextFactory.obtainDirContext, the code reads nameCallback.getName(); if null (no principal was supplied), it throws RuntimeException('Could not obtain principal'). The callbacks were 'handled' without error but the handler never set a name, so an LDAP bind DN is unavailable and the DirContext cannot be created.

Source

Thrown at extensions/elytron-security-ldap/runtime/src/main/java/io/quarkus/elytron/security/ldap/QuarkusDirContextFactory.java:66

        return createDirContext(securityPrincipal, charPassword, mode);
    }

    @Override
    public DirContext obtainDirContext(CallbackHandler handler, ReferralMode mode) throws NamingException {
        NameCallback nameCallback = new NameCallback("Principal Name");
        PasswordCallback passwordCallback = new PasswordCallback("Password", false);

        try {
            handler.handle(new Callback[] { nameCallback, passwordCallback });
        } catch (Exception e) {
            throw new RuntimeException("Could not obtain credential", e);
            //            throw log.couldNotObtainCredentialWithCause(e);
        }

        String securityPrincipal = nameCallback.getName();

        if (securityPrincipal == null) {
            throw new RuntimeException("Could not obtain principal");
            //            throw log.couldNotObtainPrincipal();
        }

        char[] securityCredential = passwordCallback.getPassword();

        if (securityCredential == null) {
            throw new RuntimeException("Could not obtain credential");
            //            throw log.couldNotObtainCredential();
        }

        return createDirContext(securityPrincipal, securityCredential, mode);
    }

    private DirContext createDirContext(String securityPrincipal, char[] securityCredential, ReferralMode mode)
            throws NamingException {
        final ClassLoader oldClassLoader = setClassLoaderTo(targetClassLoader);
        try {
            Hashtable<String, Object> env = new Hashtable<>();

View on GitHub (pinned to e1c734241f)

Solutions

1. Set the LDAP bind principal in configuration (quarkus.elytron.security.ldap.dir-context.principal) to a valid DN.
2. If a custom CallbackHandler is used, ensure it calls nameCallback.setName(...) with the full bind DN.
3. Validate configuration at startup (fail fast if the principal property is blank) rather than at first authentication.
4. Check environment-specific profiles: the property may be present locally but missing in the deployed profile.

Example fix

// before (application.properties): principal missing
quarkus.elytron.security.ldap.dir-context.url=ldap://localhost:10389
// after
quarkus.elytron.security.ldap.dir-context.url=ldap://localhost:10389
quarkus.elytron.security.ldap.dir-context.principal=uid=admin,ou=system

// fail fast if the bind DN is missing before LDAP operations
String bindDn = config.dirContext().principal();
if (bindDn == null || bindDn.isBlank()) {
    throw new IllegalStateException("quarkus.elytron.security.ldap.dir-context.principal is not set");
}

try {
    DirContext ctx = dirContextFactory.obtainDirContext();
} catch (RuntimeException e) {
    if ("Could not obtain principal".equals(e.getMessage())) {
        throw new DeploymentException("LDAP bind principal missing from configuration", e);
    }
    throw e;
}

When it happens

Trigger: The CallbackHandler handles the callbacks but never calls nameCallback.setName(...) — e.g. the configured bind DN property is missing/blank, or a custom handler only sets the password.

Common situations: quarkus.elytron.security.ldap bind DN (dir-context principal) omitted from configuration; empty string config value; custom credential supplier returning null name; env-specific config file missing the property (works locally, fails in CI/prod).

Related errors

• Could not obtain credential
• No PropertiesRealmConfig users/roles settings found. Configu
• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• Build step '%s' does not produce any build item and thus wil

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7a3aa373287060b2. Report an issue: GitHub.