{"record":{"id":"60e2147c6064da42","repo":"spring-projects/spring-security","slug":"userdetailsservice-must-be-set-60e214","errorCode":null,"errorMessage":"userDetailsService must be set","messagePattern":"userDetailsService must be set","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceAuthenticationProvider.java","lineNumber":74,"sourceCode":"\n\tprivate static final Log LOG = LogFactory.getLog(KerberosServiceAuthenticationProvider.class);\n\n\tprivate @Nullable KerberosTicketValidator ticketValidator;\n\n\tprivate @Nullable UserDetailsService userDetailsService;\n\n\tprivate UserDetailsChecker userDetailsChecker = new AccountStatusUserDetailsChecker();\n\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tKerberosServiceRequestToken auth = (KerberosServiceRequestToken) authentication;\n\t\tbyte[] token = auth.getToken();\n\t\tLOG.debug(\"Try to validate Kerberos Token\");\n\t\tif (this.ticketValidator == null) {\n\t\t\tthrow new IllegalStateException(\"ticketValidator must be set\");\n\t\t}\n\t\tif (this.userDetailsService == null) {\n\t\t\tthrow new IllegalStateException(\"userDetailsService must be set\");\n\t\t}\n\t\tKerberosTicketValidation ticketValidation = this.ticketValidator.validateTicket(token);\n\t\tLOG.debug(\"Successfully validated \" + ticketValidation.username());\n\t\tUserDetails userDetails = this.userDetailsService.loadUserByUsername(ticketValidation.username());\n\t\tthis.userDetailsChecker.check(userDetails);\n\t\tadditionalAuthenticationChecks(userDetails, auth);\n\t\tKerberosServiceRequestToken responseAuth = new KerberosServiceRequestToken(userDetails, ticketValidation,\n\t\t\t\tuserDetails.getAuthorities(), token);\n\t\tresponseAuth.setDetails(authentication.getDetails());\n\t\treturn responseAuth;\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<? extends Object> auth) {\n\t\treturn KerberosServiceRequestToken.class.isAssignableFrom(auth);\n\t}\n\n\t@Override","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceAuthenticationProvider.java#L56-L92","documentation":"KerberosServiceAuthenticationProvider needs a UserDetailsService to turn the validated ticket's username into a UserDetails. It throws IllegalStateException in authenticate() when `userDetailsService` is null.","triggerScenarios":"Processing a KerberosServiceRequestToken with a provider on which setUserDetailsService was never called (after ticketValidator checks pass).","commonSituations":"SPNEGO setups where the validator is configured but the user-details wiring was omitted, or bean injection failures during context startup.","solutions":["Call setUserDetailsService(...) on the provider (KerberosUserDetailsService works for LDAP-backed or simple setups).","Ensure the UserDetailsService bean exists and is injected.","Validate provider configuration at startup with tests so missing wiring is caught before deployment."],"exampleFix":"// before\nprovider.setTicketValidator(validator);\n// after\nprovider.setTicketValidator(validator);\nprovider.setUserDetailsService(new KerberosUserDetailsService());","handlingStrategy":"validation","validationCode":"if (provider instanceof KerberosServiceAuthenticationProvider k && k.getUserDetailsService() == null) throw new IllegalStateException(\"userDetailsService not wired\");","typeGuard":null,"tryCatchPattern":"try {\n  return authenticationManager.authenticate(kerberosToken);\n} catch (IllegalStateException e) {\n  LOG.error(\"Provider missing userDetailsService: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Configure the full provider (validator + UDS) before registering it in the manager.","Assert configuration in a @PostConstruct or context test.","Keep provider wiring centralized in one configuration class."],"tags":["kerberos","spnego","misconfiguration"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}