{"record":{"id":"4f2ea5200e35dffa","repo":"spring-projects/spring-security","slug":"kerberosclient-must-be-set","errorCode":null,"errorMessage":"kerberosClient must be set","messagePattern":"kerberosClient must be set","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java","lineNumber":45,"sourceCode":"\n/**\n * {@link AuthenticationProvider} for kerberos.\n *\n * @author Mike Wiesner\n * @author Bogdan Mustiata\n * @since 1.0\n */\npublic class KerberosAuthenticationProvider implements AuthenticationProvider {\n\n\tprivate @Nullable KerberosClient kerberosClient;\n\n\tprivate @Nullable UserDetailsService userDetailsService;\n\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tUsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;\n\t\tif (this.kerberosClient == null) {\n\t\t\tthrow new IllegalStateException(\"kerberosClient must be set\");\n\t\t}\n\t\tif (this.userDetailsService == null) {\n\t\t\tthrow new IllegalStateException(\"userDetailsService must be set\");\n\t\t}\n\t\tObject credentials = auth.getCredentials();\n\t\tif (credentials == null) {\n\t\t\tthrow new IllegalArgumentException(\"credentials cannot be null\");\n\t\t}\n\t\tJaasSubjectHolder subjectHolder = this.kerberosClient.login(auth.getName(), credentials.toString());\n\t\tString username = subjectHolder.getUsername();\n\t\tif (username == null) {\n\t\t\tthrow new IllegalStateException(\"username cannot be null\");\n\t\t}\n\t\tUserDetails userDetails = this.userDetailsService.loadUserByUsername(username);\n\t\tKerberosUsernamePasswordAuthenticationToken output = new KerberosUsernamePasswordAuthenticationToken(\n\t\t\t\tuserDetails, credentials, userDetails.getAuthorities(), subjectHolder);\n\t\toutput.setDetails(authentication.getDetails());\n\t\treturn output;","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java#L27-L63","documentation":"KerberosAuthenticationProvider.authenticate requires a KerberosClient to perform the JAAS login. The provider throws IllegalStateException when `kerberosClient` was never injected, meaning the provider was not fully configured before use.","triggerScenarios":"Adding a KerberosAuthenticationProvider to the AuthenticationManager (e.g. via WebSecurityConfigurerAdapter) without calling setKerberosClient, then attempting a username/password authentication.","commonSituations":"Copy-pasting a security config where the KerberosClient bean wiring was dropped or the bean is defined in a profile that isn't active, so the field stays null.","solutions":["Call setKerberosClient(...) with a configured KerberosClient (e.g. SunJaasKerberosClient) before the provider processes any authentication.","Ensure the KerberosClient bean exists and is injected into the provider.","Verify active Spring profiles actually register the client bean."],"exampleFix":"// before\nKerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();\nprovider.setUserDetailsService(myUds);\n// after\nSunJaasKerberosClient client = new SunJaasKerberosClient();\nclient.setDebug(true);\nKerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();\nprovider.setKerberosClient(client);\nprovider.setUserDetailsService(myUds);","handlingStrategy":"validation","validationCode":"if (provider instanceof KerberosAuthenticationProvider k && k.getKerberosClient() == null) throw new IllegalStateException(\"kerberosClient not wired\");","typeGuard":null,"tryCatchPattern":"try {\n  return authenticationManager.authenticate(auth);\n} catch (IllegalStateException e) {\n  LOG.error(\"KerberosAuthenticationProvider misconfigured: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Configure providers via @Bean methods that wire all collaborators.","Add a startup integration test authenticating against the provider.","Fail fast by calling provider lifecycle checks in a @PostConstruct."],"tags":["kerberos","spring-security","misconfiguration"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}