{"record":{"id":"84ada7ef752d3a48","repo":"spring-projects/spring-security","slug":"userdetailsservice-must-be-set","errorCode":null,"errorMessage":"userDetailsService must be set","messagePattern":"userDetailsService must be set","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java","lineNumber":48,"sourceCode":" *\n * @author Mike Wiesner\n * @author Bogdan Mustiata\n * @since 1.0\n */\npublic class KerberosAuthenticationProvider implements AuthenticationProvider {\n\n\tprivate @Nullable KerberosClient kerberosClient;\n\n\tprivate @Nullable UserDetailsService userDetailsService;\n\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tUsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;\n\t\tif (this.kerberosClient == null) {\n\t\t\tthrow new IllegalStateException(\"kerberosClient must be set\");\n\t\t}\n\t\tif (this.userDetailsService == null) {\n\t\t\tthrow new IllegalStateException(\"userDetailsService must be set\");\n\t\t}\n\t\tObject credentials = auth.getCredentials();\n\t\tif (credentials == null) {\n\t\t\tthrow new IllegalArgumentException(\"credentials cannot be null\");\n\t\t}\n\t\tJaasSubjectHolder subjectHolder = this.kerberosClient.login(auth.getName(), credentials.toString());\n\t\tString username = subjectHolder.getUsername();\n\t\tif (username == null) {\n\t\t\tthrow new IllegalStateException(\"username cannot be null\");\n\t\t}\n\t\tUserDetails userDetails = this.userDetailsService.loadUserByUsername(username);\n\t\tKerberosUsernamePasswordAuthenticationToken output = new KerberosUsernamePasswordAuthenticationToken(\n\t\t\t\tuserDetails, credentials, userDetails.getAuthorities(), subjectHolder);\n\t\toutput.setDetails(authentication.getDetails());\n\t\treturn output;\n\n\t}\n","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java#L30-L66","documentation":"KerberosAuthenticationProvider needs a UserDetailsService to load the authenticated user. It throws IllegalStateException in authenticate() when `userDetailsService` was never set, indicating incomplete provider configuration.","triggerScenarios":"Registering a KerberosAuthenticationProvider without calling setUserDetailsService, then handling an authentication request.","commonSituations":"Bean wiring mistakes in security configuration, or refactoring that removed the UserDetailsService bean leaving the provider unconfigured.","solutions":["Call setUserDetailsService(...) with a UserDetailsService (e.g. a KerberosUserDetailsService or your own) before authentication requests arrive.","Ensure the UserDetailsService bean is in the application context and injected into the provider.","Double-check afterPropertiesSet/bean lifecycle so the provider is validated at startup rather than at request time."],"exampleFix":"// before\nKerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();\nprovider.setKerberosClient(client);\n// after\nKerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();\nprovider.setKerberosClient(client);\nprovider.setUserDetailsService(new KerberosUserDetailsService());","handlingStrategy":"validation","validationCode":"if (provider instanceof KerberosAuthenticationProvider k && k.getUserDetailsService() == null) throw new IllegalStateException(\"userDetailsService not wired\");","typeGuard":null,"tryCatchPattern":"try {\n  return authenticationManager.authenticate(auth);\n} catch (IllegalStateException e) {\n  LOG.error(\"Provider missing userDetailsService: {}\", e.getMessage());\n  throw e;\n}","preventionTips":["Set both kerberosClient and userDetailsService together in one config method.","Write a context-load test asserting provider fields are populated.","Avoid constructing providers inline in security DSL without collaborators."],"tags":["kerberos","spring-security","misconfiguration"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}