{"record":{"id":"58aa60dc6c9e81f5","repo":"spring-projects/spring-security","slug":"ticketvalidator-must-be-set","errorCode":null,"errorMessage":"ticketValidator must be set","messagePattern":"ticketValidator must be set","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceAuthenticationProvider.java","lineNumber":71,"sourceCode":" * @see UserDetailsService\n */\npublic class KerberosServiceAuthenticationProvider implements AuthenticationProvider, InitializingBean {\n\n\tprivate static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class);\n\n\tprivate @Nullable KerberosTicketValidator ticketValidator;\n\n\tprivate @Nullable UserDetailsService userDetailsService;\n\n\tprivate UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();\n\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tKerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;\n\t\tbyte[] token = auth.getToken();\n\t\tLOG.debug(\"Try to validate Kerberos Token\");\n\t\tif (this.ticketValidator == null) {\n\t\t\tthrow new IllegalStateException(\"ticketValidator must be set\");\n\t\t}\n\t\tif (this.userDetailsService == null) {\n\t\t\tthrow new IllegalStateException(\"userDetailsService must be set\");\n\t\t}\n\t\tKerberosTicketValidation ticketValidation = this.ticketValidator.validateTicket(token);\n\t\tLOG.debug(\"Successfully validated \" + ticketValidation.username());\n\t\tUserDetails userDetails = this.userDetailsService.loadUserByUsername(ticketValidation.username());\n\t\tthis.userDetailsChecker.check(userDetails);\n\t\tadditionalAuthenticationChecks(userDetails, auth);\n\t\tKerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(userDetails, ticketValidation,\n\t\t\t\tuserDetails.getAuthorities(), token);\n\t\tresponseAuth.setDetails(authentication.getDetails());\n\t\treturn responseAuth;\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<? extends Object> auth) {\n\t\treturn KerberosServiceRequestToken.class.isAssignableFrom(auth);","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceAuthenticationProvider.java#L53-L89","documentation":"KerberosServiceAuthenticationProvider.authenticate validates a Kerberos service ticket using a TicketValidator. It throws IllegalStateException when `ticketValidator` was never set, meaning the provider is not configured for SPNEGO/service-ticket authentication.","triggerScenarios":"Placing a KerberosServiceAuthenticationProvider in the AuthenticationManager without calling setTicketValidator, then processing a KerberosServiceRequestToken (SPNEGO header) request.","commonSituations":"SPNEGO filter wired to a provider whose ticket validator bean (SunJaasKerberosTicketValidator / KerberosTicketValidator) was never injected, or the bean creation failed silently in a non-active profile.","solutions":["Call setTicketValidator(...) with a configured KerberosTicketValidator (e.g. SunJaasKerberosTicketValidator with servicePrincipal and keytabLocation).","Ensure the ticket validator bean is defined and injected into the provider.","Verify the keytab file exists and is readable so bean initialization succeeds."],"exampleFix":"// before\nKerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();\nprovider.setUserDetailsService(uds);\n// after\nSunJaasKerberosTicketValidator validator = new SunJaasKerberosTicketValidator();\nvalidator.setServicePrincipal(\"HTTP/host@REALM\");\nvalidator.setKeytabLocation(\"/etc/security/http.keytab\");\nKerberosServiceAuthenticationProvider provider = new KerberosServiceAuthenticationProvider();\nprovider.setTicketValidator(validator);\nprovider.setUserDetailsService(uds);","handlingStrategy":"validation","validationCode":"if (provider instanceof KerberosServiceAuthenticationProvider k && k.getTicketValidator() == null) throw new IllegalStateException(\"ticketValidator not wired\");\nif (!Files.isReadable(Path.of(keytabLocation))) throw new IllegalStateException(\"keytab unreadable\");","typeGuard":null,"tryCatchPattern":"try {\n  return authenticationManager.authenticate(kerberosToken);\n} catch (IllegalStateException e) {\n  LOG.error(\"SPNEGO provider misconfigured: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Wire ticketValidator and userDetailsService in the same bean definition.","Verify keytab file existence/readability as a startup check.","Add an SPNEGO round-trip test in the integration suite."],"tags":["kerberos","spnego","misconfiguration"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}