quarkusio/quarkus · error · RuntimeException

Unknown password type: ${passwordType}

Error message

Unknown password type: ${passwordType}

What it means

During build-time bytecode generation of the JPA identity provider, the @PasswordProvider/PasswordType enum value from @UserDefinition is switched over. Only CUSTOM, CLEAR, and MCF are implemented; any other PasswordType falls into the default branch and fails the build. This is a deployment (build-time) failure, not a runtime exception.

Source

Thrown at extensions/security-jpa-common/deployment/src/main/java/io/quarkus/security/jpa/common/deployment/JpaSecurityIdentityUtil.java:97

                LocalVar objectToInvokeOn = bc.localVar("ppObj",
                        bc.get(thisRef.field(passwordProviderField)));

                // :getPasswordMethod(:pass);
                storedPassword = bc.invokeVirtual(
                        ClassMethodDesc.of(ClassDesc.of(passwordProviderClassStr),
                                passwordProviderMethod,
                                Password.class,
                                String.class),
                        bc.cast(objectToInvokeOn, ClassDesc.of(passwordProviderClassStr)), pass);
                break;
            case CLEAR:
                storedPassword = bc.invokeStatic(getUtilMethod("getClearPassword"), pass);
                break;
            case MCF:
                storedPassword = bc.invokeStatic(getUtilMethod("getMcfPassword"), pass);
                break;
            default:
                throw new RuntimeException("Unknown password type: " + passwordType);
        }

        // Builder builder = JpaIdentityProviderUtil.checkPassword(storedPassword, request);
        Expr builder = bc.invokeStatic(
                MethodDesc.of(JpaIdentityProviderUtil.class, "checkPassword",
                        QuarkusSecurityIdentity.Builder.class,
                        Password.class,
                        UsernamePasswordAuthenticationRequest.class),
                storedPassword, requestParam);
        LocalVar builderVar = bc.localVar("builder", QuarkusSecurityIdentity.Builder.class, builder);

        setupRoles(index, jpaSecurityDefinition, panacheEntityPredicate, userVar, builderVar, bc);
    }

    public static void buildTrustedIdentity(Index index, JpaSecurityDefinition jpaSecurityDefinition,
            PanacheEntityPredicateBuildItem panacheEntityPredicate, Expr requestParam, Expr userVar,
            BlockCreator bc) {
        // if(user == null) return null;

View on GitHub (pinned to e1c734241f)

Solutions

1. Set @Password(type = PasswordType.CLEAR), PasswordType.MCF, or PasswordType.CUSTOM (with @PasswordProvider) in your @UserDefinition entity.
2. If a custom type is needed, use PasswordType.CUSTOM and supply a class implementing the password provider via @PasswordProvider.
3. If you added a new PasswordType constant, extend the switch in JpaSecurityIdentityUtil.buildIdentity to handle it.
4. Align your Quarkus version with the PasswordType enum available in that release.

Example fix

// before
@Password(type = PasswordType.SALTED)
public String password;

// after
@Password(type = PasswordType.MCF)
public String password;

PasswordType t = userClass.getAnnotation(Password.class) != null
        ? userClass.getAnnotation(Password.class).type() : PasswordType.MCF;
if (t != PasswordType.CLEAR && t != PasswordType.MCF && t != PasswordType.CUSTOM)
    throw new IllegalArgumentException("Unsupported PasswordType: " + t);

When it happens

Trigger: Annotating a @UserDefinition entity field with @Password(type=...) whose PasswordType enum value is not CUSTOM, CLEAR, or MCF. In practice the switch is exhausted, so this fires only if a new enum constant is added to PasswordType without updating this generator, or via bytecode-generation edge cases.

Common situations: Developing against a newer/older Quarkus version where PasswordType gained constants (e.g. SALTED) that this deployment code does not handle; custom forks of PasswordType; copy-pasted annotation values from another extension.

Related errors

• The supplied 'main-class' value of '${mainClassName}' does n
• Either @ConfigRoot or @ConfigMapping is missing on ${configR
• Unable to load the config property type: ${className}
• You can only annotate one field or method with @${annotation
• The role element type must be indexed by Jandex: ${elementTy

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/105b1fc6988b0d03. Report an issue: GitHub.