quarkusio/quarkus · error · RuntimeException

Failed to get user principal

Error message

Failed to get user principal

What it means

Thrown by RootResource.posts when sec.getUserPrincipal() returns a Principal whose name is null — i.e. the Elytron security context did not authenticate the caller as expected. This signals an authentication/authorization wiring problem rather than bad input.

Source

Thrown at integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java:38

import io.quarkus.security.PermissionsAllowed;
import io.quarkus.security.identity.SecurityIdentity;
import io.quarkus.vertx.http.runtime.security.HttpSecurityUtils;

@Path("/")
public class RootResource {
    @Inject
    SecurityIdentity identity;
    @Inject
    Principal principal;

    @POST
    @Consumes(MediaType.TEXT_PLAIN)
    public String posts(String data, @Context SecurityContext sec) {
        if (data == null) {
            throw new RuntimeException("No post data");
        }
        if (sec.getUserPrincipal().getName() == null) {
            throw new RuntimeException("Failed to get user principal");
        }
        return "post success";
    }

    @GET
    @Produces(MediaType.TEXT_PLAIN)
    public String approval(@Context SecurityContext sec) {
        if (sec.getUserPrincipal().getName() == null) {
            throw new RuntimeException("Failed to get user principal");
        }
        return "get success";
    }

    @GET
    @Path("/secure")
    @Authenticated
    public String getSecure() {
        return "secure";

View on GitHub (pinned to e1c734241f)

Solutions

1. Send valid authentication credentials (e.g. Basic auth for a configured Elytron user).
2. Verify quarkus-elytron-security / properties-file identity config defines the user (quarkus.security.users.* or elytron config).
3. Ensure the endpoint requires authentication (quarkus.http.auth.permission policies) so anonymous requests never reach the method.

Example fix

// before
curl -X POST -H 'Content-Type: text/plain' -d 'hello' http://localhost:8080/rest-elytron
// after
curl -X POST -u alice:alice -H 'Content-Type: text/plain' -d 'hello' http://localhost:8080/rest-elytron

// verify credentials configured before calling the secured endpoint
if (username == null || password == null) {
    throw new IllegalStateException("Credentials required for secured POST");
}

boolean isAuthenticated(javax.ws.rs.core.SecurityContext sec) {
    return sec != null && sec.getUserPrincipal() != null && sec.getUserPrincipal().getName() != null;
}

try {
    String resp = target.request().post(Entity.text(data));
} catch (javax.ws.rs.NotAuthorizedException e) {
    log.error("Provide valid Basic auth credentials");
}

When it happens

Trigger: POSTing valid data without valid credentials (401 handled elsewhere), anonymous access allowed by config so the Principal is anonymous/unnamed, or a missing/incorrectly configured Elytron identity realm.

Common situations: Missing quarkus.http.auth.* / elytron identity configuration; wrong Basic auth credentials in the client; security disabled in dev so an anonymous principal is injected.

Related errors

• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• AuthenticationFailedException
• AuthenticationFailedException
• AuthenticationFailedException

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/5df4b759ee595258. Report an issue: GitHub.