{"record":{"id":"5f973abbc4d803d0","repo":"spring-projects/spring-security","slug":"namingexception-getmessage-5f973a","errorCode":null,"errorMessage":"<namingException.getMessage()>","messagePattern":"<namingException\\.getMessage\\(\\)>","errorType":"exception","errorClass":"UncategorizedLdapException","httpStatus":null,"severity":"error","filePath":"ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java","lineNumber":223,"sourceCode":"\t\t// TODO. add DNS lookup based on domain\n\t\tHashtable<String, Object> env = new Hashtable<>();\n\t\tenv.put(Context.SECURITY_AUTHENTICATION, \"simple\");\n\t\tString bindPrincipal = createBindPrincipal(username);\n\t\tenv.put(Context.SECURITY_PRINCIPAL, bindPrincipal);\n\t\tenv.put(Context.PROVIDER_URL, this.url);\n\t\tenv.put(Context.SECURITY_CREDENTIALS, password);\n\t\tenv.put(Context.INITIAL_CONTEXT_FACTORY, \"com.sun.jndi.ldap.LdapCtxFactory\");\n\t\tenv.put(Context.OBJECT_FACTORIES, DefaultDirObjectFactory.class.getName());\n\t\tenv.putAll(this.contextEnvironmentProperties);\n\t\ttry {\n\t\t\treturn this.contextFactory.createContext(env);\n\t\t}\n\t\tcatch (NamingException ex) {\n\t\t\tif ((ex instanceof AuthenticationException) || (ex instanceof OperationNotSupportedException)) {\n\t\t\t\thandleBindException(bindPrincipal, ex);\n\t\t\t\tthrow badCredentials(ex);\n\t\t\t}\n\t\t\tthrow LdapUtils.convertLdapException(ex);\n\t\t}\n\t}\n\n\tprivate void handleBindException(String bindPrincipal, NamingException exception) {\n\t\tthis.logger.debug(LogMessage.format(\"Authentication for %s failed:%s\", bindPrincipal, exception));\n\t\thandleResolveObj(exception);\n\t\tint subErrorCode = parseSubErrorCode(exception.getMessage());\n\t\tif (subErrorCode <= 0) {\n\t\t\tthis.logger.debug(\"Failed to locate AD-specific sub-error code in message\");\n\t\t\treturn;\n\t\t}\n\t\tthis.logger\n\t\t\t.info(LogMessage.of(() -> \"Active Directory authentication failed: \" + subCodeToLogMessage(subErrorCode)));\n\t\tif (this.convertSubErrorCodesToExceptions) {\n\t\t\traiseExceptionForErrorCode(subErrorCode, exception);\n\t\t}\n\t}\n","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java#L205-L241","documentation":"ActiveDirectoryLdapAuthenticationProvider's bindAsUser binds as the authenticating user against Active Directory. If the resulting NamingException is an AuthenticationException or OperationNotSupportedException it is treated as bad credentials; any other NamingException is converted with LdapUtils.convertLdapException(ex) and thrown with the original naming exception's message. This propagates infrastructure-level LDAP failures rather than masking them as login failures.","triggerScenarios":"Calling authenticate() (via doAuthentication -> bindAsUser) when the AD bind throws a non-authentication NamingException: server unreachable, port 636/389 wrong, DNS resolution failure, or AD refusing the operation for reasons other than bad password.","commonSituations":"AD domain controller hostname typo or unreachable DC, using wrong port (LDAPS vs LDAP), connectivity/firewall issues in DMZ, or AD returning unexpected errors like unavailable server or time skew (KRB5/NTLM mismatches).","solutions":["Verify the AD domain and URL configured in ActiveDirectoryLdapAuthenticationProvider (domain + rootDn/url) resolve and are reachable from the app.","Check the cause chain of the converted exception for the underlying JNDI diagnostic.","If using LDAPS, confirm the DC certificate is trusted by the JVM truststore to avoid SSL handshake NamingExceptions.","Confirm port correctness: 389/636 (or 3268/3269 for GC) and no firewall blocking."],"exampleFix":"// before: wrong URL scheme causing connect NamingException\nnew ActiveDirectoryLdapAuthenticationProvider(\"example.com\", \"ldaps://dc.example.com:389\");\n// after: port matches scheme\nnew ActiveDirectoryLdapAuthenticationProvider(\"example.com\", \"ldaps://dc.example.com:636\");","handlingStrategy":"try-catch","validationCode":"// preflight AD connectivity and cert trust\nSSLSocketFactory f = (SSLSocketFactory) SSLSocketFactory.getDefault();\ntry (Socket s = f.createSocket(dcHost, 636)) {\n    assert s.isConnected();\n} catch (IOException e) {\n    fail(\"AD endpoint unreachable: \" + e.getMessage());\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.authenticate(token);\n} catch (org.springframework.security.authentication.InternalAuthenticationServiceException e) {\n    Throwable root = ExceptionUtils.getRootCause(e);\n    log.error(\"AD bind infrastructure failure\", root); // distinguish from BadCredentialsException\n}","preventionTips":["Smoke-test DC host:port reachability from the deployment environment.","Import LDAPS certificates into the JVM truststore before rollout.","Pin registration of the provider behind a health-check that binds as a service account.","Log the JNDI exception's message/cause separately from bad-credential paths."],"tags":["ldap","active-directory","authentication","network"],"backgroundTag":"connection-refused","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}