{"record":{"id":"316b9d771fe2692c","repo":"spring-projects/spring-security","slug":"jdbcdaoimpl-noauthority","errorCode":"JdbcDaoImpl.noAuthority","errorMessage":"User {0} has no GrantedAuthority","messagePattern":"User (.+?) has no GrantedAuthority","errorType":"exception","errorClass":"UsernameNotFoundException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/core/userdetails/jdbc/JdbcDaoImpl.java","lineNumber":204,"sourceCode":"\t\tList<UserDetails> users = loadUsersByUsername(username);\n\t\tif (users.isEmpty()) {\n\t\t\tthis.logger.debug(\"Query returned no results for user '\" + username + \"'\");\n\t\t\tthrow new UsernameNotFoundException(this.messages.getMessage(\"JdbcDaoImpl.notFound\",\n\t\t\t\t\tnew Object[] { username }, \"Username {0} not found\"));\n\t\t}\n\t\tUserDetails user = users.get(0); // contains no GrantedAuthority[]\n\t\tSet<GrantedAuthority> dbAuthsSet = new HashSet<>();\n\t\tif (this.enableAuthorities) {\n\t\t\tdbAuthsSet.addAll(loadUserAuthorities(user.getUsername()));\n\t\t}\n\t\tif (this.enableGroups) {\n\t\t\tdbAuthsSet.addAll(loadGroupAuthorities(user.getUsername()));\n\t\t}\n\t\tList<GrantedAuthority> dbAuths = new ArrayList<>(dbAuthsSet);\n\t\taddCustomAuthorities(user.getUsername(), dbAuths);\n\t\tif (dbAuths.isEmpty()) {\n\t\t\tthis.logger.debug(\"User '\" + username + \"' has no authorities and will be treated as 'not found'\");\n\t\t\tthrow new UsernameNotFoundException(this.messages.getMessage(\"JdbcDaoImpl.noAuthority\",\n\t\t\t\t\tnew Object[] { username }, \"User {0} has no GrantedAuthority\"));\n\t\t}\n\t\treturn createUserDetails(username, user, dbAuths);\n\t}\n\n\t/**\n\t * Executes the SQL <tt>usersByUsernameQuery</tt> and returns a list of UserDetails\n\t * objects. There should normally only be one matching user.\n\t */\n\tprotected List<UserDetails> loadUsersByUsername(String username) {\n\t\t// @formatter:off\n\t\tRowMapper<UserDetails> mapper = (rs, rowNum) -> {\n\t\t\tString username1 = rs.getString(1);\n\t\t\tString password = rs.getString(2);\n\t\t\tboolean enabled = rs.getBoolean(3);\n\t\t\treturn new User(username1, password, enabled, true, true, true, AuthorityUtils.NO_AUTHORITIES);\n\t\t};\n\t\t// @formatter:on","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/core/userdetails/jdbc/JdbcDaoImpl.java#L186-L222","documentation":"JdbcDaoImpl.loadUserByUsername throws UsernameNotFoundException with message key 'JdbcDaoImpl.noAuthority' when the user row exists but the combined authorities (from users-by-authorities and, if enabled, group authorities plus any addCustomAuthorities additions) end up empty. By design it is reported as 'not found' so the existence of the user is not leaked.","triggerScenarios":"User exists in the users table but the authoritiesByUsernameQuery returns no rows and enableAuthorities/enableGroupAuthorities are not configured to pick up roles.","commonSituations":"Wrong authoritiesByUsernameQuery table/column names, authorities not seeded for the user, enableAuthorities=false without group authorities enabled, custom addCustomAuthorities returning empty list.","solutions":["Check the authoritiesByUsernameQuery returns rows for the user (run it manually with the username)","Ensure enableAuthorities is true (default) or enableGroupAuthorities with correct group query if you use groups","Seed authority rows for the user in the authorities table","Add roles in addCustomAuthorities override if roles come from another source"],"exampleFix":"// before\nauthoritiesByUsernameQuery=select username,rol from authorities where username = ?\n// after (correct column name)\nauthoritiesByUsernameQuery=select username,authority from authorities where username = ?","handlingStrategy":"try-catch","validationCode":"List<?> auths = jdbc.queryForList(authoritiesByUsernameQuery, username); if (auths.isEmpty()) { /* user exists but has no roles — handle explicitly */ }","typeGuard":null,"tryCatchPattern":"try { user = dao.loadUserByUsername(username); } catch (UsernameNotFoundException ex) { // could be missing user OR missing authorities; log and deny }","preventionTips":["Ensure every user has at least one authority row","Verify authoritiesByUsernameQuery table/column names","Check enableAuthorities/enableGroupAuthorities settings match your schema","Remember both conditions surface as UsernameNotFoundException — never reveal which one to clients"],"tags":["missing-authorities","jdbc","authentication","user-not-found"],"backgroundTag":"user-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}