{"record":{"id":"205263fb87f95554","repo":"spring-projects/spring-security","slug":"exception-occurred-while-looking-up-groups-for-use","errorCode":null,"errorMessage":"Exception occurred while looking up groups for user","messagePattern":"Exception occurred while looking up groups for user","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/DefaultWASUsernameAndGroupsExtractor.java","lineNumber":137,"sourceCode":"\t@SuppressWarnings(\"unchecked\")\n\tprivate static List<String> getWebSphereGroups(final @Nullable String securityName) {\n\t\tContext context = null;\n\t\ttry {\n\t\t\t// TODO: Cache UserRegistry object\n\t\t\tcontext = new InitialContext();\n\t\t\tObject objRef = context.lookup(USER_REGISTRY);\n\t\t\tObject userReg = invokeMethod(getNarrowMethod(), null, objRef,\n\t\t\t\t\tClass.forName(\"com.ibm.websphere.security.UserRegistry\"));\n\t\t\tlogger.debug(LogMessage.format(\"Determining WebSphere groups for user %s using WebSphere UserRegistry %s\",\n\t\t\t\t\tsecurityName, userReg));\n\t\t\tfinal Collection<String> groups = (Collection<String>) invokeMethod(getGroupsForUserMethod(), userReg,\n\t\t\t\t\tnew Object[] { securityName });\n\t\t\tlogger.debug(LogMessage.format(\"Groups for user %s: %s\", securityName, groups));\n\t\t\treturn new ArrayList<>(groups);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tlogger.error(\"Exception occurred while looking up groups for user\", ex);\n\t\t\tthrow new RuntimeException(\"Exception occurred while looking up groups for user\", ex);\n\t\t}\n\t\tfinally {\n\t\t\tcloseContext(context);\n\t\t}\n\t}\n\n\tprivate static void closeContext(@Nullable Context context) {\n\t\ttry {\n\t\t\tif (context != null) {\n\t\t\t\tcontext.close();\n\t\t\t}\n\t\t}\n\t\tcatch (NamingException ex) {\n\t\t\tlogger.debug(\"Exception occurred while closing context\", ex);\n\t\t}\n\t}\n\n\tprivate static Object invokeMethod(Method method, @Nullable Object instance, Object... args) {","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/DefaultWASUsernameAndGroupsExtractor.java#L119-L155","documentation":"DefaultWASUsernameAndGroupsExtractor.getWebSphereGroups performs a JNDI lookup against the WebSphere user registry to resolve group memberships for a security name. Any failure during the LDAP/JNDI query (communication failure, bad principal, registry unavailable, naming exception) is caught and rethrown as an unchecked RuntimeException wrapping the original exception. The library throws this because group lookup is considered essential to WebSphere pre-authentication and cannot silently return empty groups.","triggerScenarios":"Calling getWebSphereGroups(securityName) when the configured WebSphere user registry is unreachable, the JNDI context settings are wrong, the securityName does not exist in the registry, or any underlying naming/communication exception occurs during groupsForUser invocation.","commonSituations":"WebSphere admin console user registry misconfiguration; LDAP server down or firewall blocking the directory port; running outside a WebSphere container where WAS JNDI properties are absent; user was deleted from LDAP after authentication; typo in the security name passed by the pre-auth filter.","solutions":["Verify the WebSphere global security user registry (LDAP) is reachable: check host/port and test with the wsadmin or admin console 'Test connection'.","Check that the securityName passed to getWebSphereGroups actually exists in the registry.","Inspect the wrapped cause (ex.getCause()) in the stack trace for the real JNDI/naming error (e.g. CommunicationException, NameNotFoundException).","Confirm the application is running inside WebSphere/WAS with proper JAAS subject and JNDI environment; running on plain Tomcat will not work.","Increase logging (logger.error already logs the cause) and fix the underlying registry configuration in WAS admin console.","If groups are optional, catch the RuntimeException around the pre-auth call and degrade gracefully instead of failing the request."],"exampleFix":"// before\nList<String> groups = extractor.getWebSphereGroups(securityName);\n// after\nList<String> groups;\ntry {\n    groups = extractor.getWebSphereGroups(securityName);\n} catch (RuntimeException ex) {\n    logger.warn(\"Group lookup failed for \" + securityName + \": \" + ex.getCause());\n    groups = Collections.emptyList();\n}","handlingStrategy":"try-catch","validationCode":"// validate user exists in registry before group lookup\nif (securityName == null || securityName.isBlank()) {\n    throw new IllegalArgumentException(\"securityName is required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    List<String> groups = extractor.getWebSphereGroups(securityName);\n} catch (RuntimeException ex) {\n    logger.error(\"Group lookup failed, cause: \" + ex.getCause(), ex);\n    groups = Collections.emptyList(); // or deny access\n}","preventionTips":["Validate WAS/LDAP registry connectivity before authentication flows","Log the wrapped cause for the real naming error","Fail fast at startup with a probe JNDI lookup","Run only inside a properly configured WebSphere container"],"tags":["jndi","websphere","ldap","runtime-exception"],"backgroundTag":"class-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}