{"record":{"id":"37dc7846396c6f50","repo":"spring-projects/spring-security","slug":"login-cannot-complete-authentication-not-found-in","errorCode":null,"errorMessage":"Login cannot complete, authentication not found in security context","messagePattern":"Login cannot complete, authentication not found in security context","errorType":"exception","errorClass":"LoginException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/authentication/jaas/SecurityContextLoginModule.java","lineNumber":154,"sourceCode":"\t\t}\n\t}\n\n\t/**\n\t * Authenticate the <code>Subject</code> (phase one) by extracting the Spring Security\n\t * <code>Authentication</code> from the current <code>SecurityContext</code>.\n\t * @return true if the authentication succeeded, or false if this\n\t * <code>LoginModule</code> should be ignored.\n\t * @throws LoginException if the authentication fails\n\t */\n\t@Override\n\tpublic boolean login() throws LoginException {\n\t\tthis.authen = this.securityContextHolderStrategy.getContext().getAuthentication();\n\t\tif (this.authen != null) {\n\t\t\treturn true;\n\t\t}\n\t\tString msg = \"Login cannot complete, authentication not found in security context\";\n\t\tif (!this.ignoreMissingAuthentication) {\n\t\t\tthrow new LoginException(msg);\n\t\t}\n\t\tlog.warn(msg);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Log out the <code>Subject</code>.\n\t * @return true if this method succeeded, or false if this <code>LoginModule</code>\n\t * should be ignored.\n\t */\n\t@Override\n\tpublic boolean logout() {\n\t\tif (this.authen == null) {\n\t\t\treturn false;\n\t\t}\n\t\tAssert.notNull(this.subject, \"subject cannot be null\");\n\t\tthis.subject.getPrincipals().remove(this.authen);\n\t\tthis.authen = null;","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/authentication/jaas/SecurityContextLoginModule.java#L136-L172","documentation":"SecurityContextLoginModule.login() throws LoginException when no Authentication is found in the SecurityContext, i.e. login() is invoked before Spring Security has authenticated the user. JAAS LoginModule semantics require the module to find a pre-populated Authentication to 'share' into the JAAS Subject. If ignoreMissingAuthentication is true it logs a warning and returns false instead of throwing.","triggerScenarios":"Configuring SecurityContextLoginModule in a JAAS login configuration for a request that has not been authenticated by Spring Security (anonymous or unauthenticated session); calling login() outside a Spring Security filter chain so the SecurityContextHolder is empty; the JAAS authentication loop running before the SecurityContextPersistenceFilter/SecurityContextHolderFilter populated the context.","commonSituations":"Bridging legacy JAAS-based systems (e.g. JBoss, WebSphere SSO) with Spring Security where the filter chain is not registered or ordered before the JAAS callback; programmatic Subject.doAs() usage without first setting a SecurityContext in tests.","solutions":["Ensure the request passes through the Spring Security filter chain so the SecurityContext is populated before the JAAS LoginModule runs","Set ignoreMissingAuthentication=true in the JAAS configuration if an absent Authentication should be tolerated rather than fatal","Populate the SecurityContext manually (SecurityContextHolder.getContext().setAuthentication(...)) before invoking the LoginModule in tests or programmatic flows","Verify the shared state / securityContextHolderStrategy sees the same thread; do not call login() from a different thread than the one holding the context"],"exampleFix":"// before (jaas.conf)\nExample { org.springframework.security.authentication.jaas.SecurityContextLoginModule required; };\n// after\ntolerant { org.springframework.security.authentication.jaas.SecurityContextLoginModule required ignoreMissingAuthentication=true; };","handlingStrategy":"type-guard","validationCode":"if (SecurityContextHolder.getContext().getAuthentication() == null || !SecurityContextHolder.getContext().getAuthentication().isAuthenticated()) { throw new IllegalStateException(\"run after Spring Security filter chain has authenticated the request\"); }","typeGuard":"boolean hasAuthentication() { Authentication a = SecurityContextHolder.getContext().getAuthentication(); return a != null && a.isAuthenticated() && !(a instanceof AnonymousAuthenticationToken); }","tryCatchPattern":"try { return loginContext.login(); } catch (LoginException e) { log.warn(\"No SecurityContext authentication for JAAS login\", e); return false; }","preventionTips":["Register the JAAS callback only inside requests processed by the Spring Security filter chain","Set ignoreMissingAuthentication=true when absence of authentication is an expected, tolerated case","Never call the LoginModule from a thread without a populated SecurityContextHolder"],"tags":["jaas","spring-security","security-context","login-module"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}