{"record":{"id":"2f9eb2f3a42b0d7d","repo":"spring-projects/spring-security","slug":"namingexception-getmessage","errorCode":null,"errorMessage":"<namingException.getMessage()>","messagePattern":"<namingException\\.getMessage\\(\\)>","errorType":"exception","errorClass":"UncategorizedLdapException","httpStatus":null,"severity":"error","filePath":"ldap/src/main/java/org/springframework/security/ldap/authentication/BindAuthenticator.java","lineNumber":135,"sourceCode":"\t\t\tif (attrs == null || attrs.size() == 0) {\n\t\t\t\tattrs = ctx.getAttributes(userDn, getUserAttributes());\n\t\t\t}\n\t\t\tDirContextAdapter result = new DirContextAdapter(attrs, userDn, ctxSource.getBaseLdapName());\n\t\t\tif (ppolicy != null) {\n\t\t\t\tresult.setAttributeValue(ppolicy.getID(), ppolicy);\n\t\t\t}\n\t\t\tlogger.debug(LogMessage.format(\"Bound %s\", fullDn));\n\t\t\treturn result;\n\t\t}\n\t\tcatch (NamingException ex) {\n\t\t\t// This will be thrown if an invalid user name is used and the method may\n\t\t\t// be called multiple times to try different names, so we trap the exception\n\t\t\t// unless a subclass wishes to implement more specialized behaviour.\n\t\t\thandleIfBindException(userDnStr, username, ex);\n\t\t}\n\t\tcatch (javax.naming.NamingException ex) {\n\t\t\tif (!this.alsoHandleJavaxNamingBindExceptions) {\n\t\t\t\tthrow LdapUtils.convertLdapException(ex);\n\t\t\t}\n\t\t\thandleIfBindException(userDnStr, username, LdapUtils.convertLdapException(ex));\n\t\t}\n\t\tfinally {\n\t\t\tLdapUtils.closeContext(ctx);\n\t\t}\n\t\treturn null;\n\t}\n\n\tprivate void handleIfBindException(String dn, String username, org.springframework.ldap.NamingException naming) {\n\t\tif ((naming instanceof org.springframework.ldap.AuthenticationException)\n\t\t\t\t|| (naming instanceof org.springframework.ldap.OperationNotSupportedException)) {\n\t\t\thandleBindException(dn, username, naming);\n\t\t}\n\t\telse {\n\t\t\tthrow naming;\n\t\t}\n\t}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/ldap/src/main/java/org/springframework/security/ldap/authentication/BindAuthenticator.java#L117-L153","documentation":"During LDAP bind authentication, a javax.naming.NamingException occurred while binding the user's DN. BindAuthenticator wraps it via LdapUtils.convertLdapException(ex) and rethrows it as a Spring Security LDAP runtime exception (org.springframework.ldap.CommunicationException / AuthenticationException etc., whose message is the original naming exception's message). This surfaces low-level directory errors (connection refused, DNS failure, invalid DN) to callers of authenticate().","triggerScenarios":"Calling BindAuthenticator.authenticate() (directly or via LdapAuthenticationProvider) when the LDAP bind operation throws a NamingException that is not an AuthenticationException, or when alsoHandleJavaxNamingBindExceptions is false so bind exceptions are not swallowed for retry with alternative DNs.","commonSituations":"LDAP server down or unreachable (network/firewall), wrong port or URL in the context source, malformed user DN patterns, TLS/SSL handshake problems, or directory service failures (e.g. referral errors) during login.","solutions":["Verify the LDAP server is reachable: test with ldapsearch or telnet to host:port from the app host.","Check the context source URL/port/base DN configuration (e.g. DefaultSpringSecurityContextSource) for typos.","Inspect the converted exception's message/cause to identify the underlying JNDI error code (e.g. communication vs name-not-found).","If user DNs are wrong, fix userSearchFilter/userDnPatterns so binds target valid entries."],"exampleFix":"// before: vague bind failure with raw JNDI message\nauth.ldapAuthentication().userDnPatterns(\"uid={0},ou=people\")\n  .contextSource().url(\"ldaps://ldap.example.com:389\");\n// after: correct scheme/port and reachable server\nauth.ldapAuthentication().userDnPatterns(\"uid={0},ou=people\")\n  .contextSource().url(\"ldap://ldap.example.com:389\");","handlingStrategy":"try-catch","validationCode":"// preflight LDAP reachability\ntry (LdapContext ctx = contextSource.getContext(\"\", \"\")) {\n    // server reachable and manager bind works\n} catch (Exception e) {\n    fail(\"LDAP unavailable: \" + e.getMessage());\n}","typeGuard":null,"tryCatchPattern":"try {\n    authProvider.authenticate(token);\n} catch (org.springframework.ldap.CommunicationException e) {\n    // directory unreachable — alert ops, show 'service unavailable'\n} catch (AuthenticationException e) {\n    // bad credentials path\n}","preventionTips":["Add a startup health check that opens an anonymous/manager LDAP context.","Store LDAP URLs/ports in externalized, validated configuration.","Monitor JNDI error codes and alert on communication failures.","Use userSearch instead of raw DN patterns when DNs vary."],"tags":["ldap","authentication","bind","network"],"backgroundTag":"connection-refused","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}