{"record":{"id":"21940bb34a9d38d1","repo":"spring-projects/spring-security","slug":"required-class-classname-not-found-21940b","errorCode":null,"errorMessage":"Required class <className> not found","messagePattern":"Required class <className> not found","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/DefaultWASUsernameAndGroupsExtractor.java","lineNumber":234,"sourceCode":"\t\t}\n\t\treturn narrow;\n\t}\n\n\t// SEC-803\n\tprivate static Class<?> getWSCredentialClass() {\n\t\tif (wsCredentialClass == null) {\n\t\t\twsCredentialClass = getClass(\"com.ibm.websphere.security.cred.WSCredential\");\n\t\t}\n\t\treturn wsCredentialClass;\n\t}\n\n\tprivate static Class<?> getClass(String className) {\n\t\ttry {\n\t\t\treturn Class.forName(className);\n\t\t}\n\t\tcatch (ClassNotFoundException ex) {\n\t\t\tlogger.error(\"Required class \" + className + \" not found\");\n\t\t\tthrow new RuntimeException(\"Required class \" + className + \" not found\", ex);\n\t\t}\n\t}\n\n}\n","sourceCodeStart":216,"sourceCodeEnd":239,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/DefaultWASUsernameAndGroupsExtractor.java#L216-L239","documentation":"The private getClass helper loads a WebSphere credential/API class by name via Class.forName. If the class is not on the classpath, the ClassNotFoundException is rethrown as a RuntimeException \"Required class <className> not found\". Callers like getWSCredentialClass and authenticationPrincipal rely on this to access WAS credential types, so it fails whenever WAS runtime classes are absent.","triggerScenarios":"Any call path through logger, log, credentials, getWSCredentialClass, authenticationPrincipal, or spel that needs a WAS class (e.g. com.ibm.websphere.security.cred.WSCredential) when that class cannot be loaded.","commonSituations":"Running the WebSphere pre-auth integration outside WebSphere (Tomcat/Embedded); WAS client/runtime jars not shipped with the deployment; classloader isolation in WAS preventing the webapp from seeing provider classes; refactoring that renamed the expected WAS class.","solutions":["Add the missing WAS class's jar (WAS_HOME/plugins, com.ibm.ws.runtime.jar or the WAS client jar) to the application classpath.","Deploy on/against a genuine WebSphere runtime; the pre-auth websphere package is WAS-specific and will not work on other containers.","Check WAS classloader policy (parent-last/parent-first) so the webapp can load com.ibm.websphere.security classes from the server runtime.","Match the class name in the message against your WAS version; upgrade spring-security-web if the WAS API moved.","Fail fast at startup by verifying required com.ibm.* classes are loadable before enabling the WAS pre-auth filter."],"exampleFix":"// before\nClass<?> credentialClass = extractor.getWSCredentialClass(); // throws at runtime if absent\n// after\nboolean wasPresent;\ntry {\n    Class.forName(\"com.ibm.websphere.security.cred.WSCredential\");\n    wasPresent = true;\n} catch (ClassNotFoundException e) {\n    wasPresent = false;\n}\nif (!wasPresent) {\n    throw new IllegalStateException(\"WSCredential class missing - deploy on WebSphere or add WAS runtime jars\");\n}","handlingStrategy":"validation","validationCode":"// gate the WAS pre-auth integration on credential class availability at startup\nstatic {\n    try {\n        Class.forName(\"com.ibm.websphere.security.cred.WSCredential\");\n    } catch (ClassNotFoundException e) {\n        throw new IllegalStateException(\n            \"com.ibm.websphere.security.cred.WSCredential not found: deploy on WebSphere or add WAS runtime jars\", e);\n    }\n}","typeGuard":"boolean credentialClassAvailable() {\n    try {\n        Class.forName(\"com.ibm.websphere.security.cred.WSCredential\");\n        return true;\n    } catch (ClassNotFoundException e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    WSCredential cred = extractor.getCredentials(subject);\n} catch (RuntimeException ex) {\n    if (ex.getCause() instanceof ClassNotFoundException) {\n        throw new IllegalStateException(\"WSCredential class not on classpath\", ex);\n    }\n    throw ex;\n}","preventionTips":["Run the integration only inside a WebSphere container","Check WAS classloader policy so com.ibm.* provider classes are visible to the webapp","Verify required WAS classes with Class.forName checks during deployment smoke tests","Keep WAS runtime jars and spring-security-web versions consistent with your server"],"tags":["reflection","websphere","classpath","classnotfound"],"backgroundTag":"class-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}