{"record":{"id":"938b234b085a5cf9","repo":"spring-projects/spring-security","slug":"user-username-does-not-exist","errorCode":null,"errorMessage":"user '{username}' does not exist","messagePattern":"user '(.+?)' does not exist","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java","lineNumber":163,"sourceCode":"\t\tif (this.authenticationManager != null) {\n\t\t\tthis.logger.debug(LogMessage.format(\"Reauthenticating user '%s' for password change request.\", username));\n\t\t\tthis.authenticationManager\n\t\t\t\t.authenticate(UsernamePasswordAuthenticationToken.unauthenticated(username, oldPassword));\n\t\t}\n\t\telse {\n\t\t\tthis.logger.debug(\"No authentication manager set. Password won't be re-checked.\");\n\t\t}\n\t\tMutableUserDetails user = this.users.get(username.toLowerCase(Locale.ROOT));\n\t\tAssert.state(user != null, \"Current user doesn't exist in database.\");\n\t\tuser.setPassword(newPassword);\n\t}\n\n\t@Override\n\tpublic UserDetails updatePassword(UserDetails user, @Nullable String newPassword) {\n\t\tString username = user.getUsername();\n\t\tMutableUserDetails mutableUser = this.users.get(username.toLowerCase(Locale.ROOT));\n\t\tif (mutableUser == null) {\n\t\t\tthrow new RuntimeException(\"user '\" + username + \"' does not exist\");\n\t\t}\n\t\tmutableUser.setPassword(newPassword);\n\t\treturn mutableUser;\n\t}\n\n\t@Override\n\tpublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n\t\tUserDetails user = this.users.get(username.toLowerCase(Locale.ROOT));\n\t\tif (user == null) {\n\t\t\tthrow UsernameNotFoundException.fromUsername(username);\n\t\t}\n\t\tif (user instanceof CredentialsContainer) {\n\t\t\treturn user;\n\t\t}\n\t\treturn new User(user.getUsername(), user.getPassword(), user.isEnabled(), user.isAccountNonExpired(),\n\t\t\t\tuser.isCredentialsNonExpired(), user.isAccountNonLocked(), user.getAuthorities());\n\t}\n","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java#L145-L181","documentation":"InMemoryUserDetailsManager.updatePassword looks up the user by lowercased username in its internal users map; if absent it throws a plain RuntimeException stating the user does not exist. Unlike updatePassword in some managers this is not a typed UsernameNotFoundException — it is an unmanaged failure signaling a caller bug or data mismatch, since the user should already have been loaded from this manager.","triggerScenarios":"Passing a UserDetails instance that was never created via this manager (e.g., from another UserDetailsService); username case differences that do not lowercase-match a stored key; the user having been deleted (deleteUser) before updatePassword runs; calling updatePassword after changePassword-related flows removed the entry.","commonSituations":"Application code mixing multiple UserDetailsService implementations; tests constructing UserDetails objects manually then calling updatePassword; race between user deletion and password update in admin tooling.","solutions":["Verify the user exists in this same manager before updating: assert userExists(user.getUsername()) is true","Only pass UserDetails objects that came from this manager's loadUserByUsername/createUser","Normalize the username (trim/lowercase) to match the manager's keying","Create the user first (createUser) when the intention is to add-and-set-password"],"exampleFix":"// before\nmanager.updatePassword(userFromOtherService, \"new\"); // RuntimeException\n// after\nif (manager.userExists(user.getUsername())) {\n    manager.updatePassword(user, \"new\");\n}","handlingStrategy":"validation","validationCode":"if (!manager.userExists(user.getUsername())) {\n    throw new UsernameNotFoundException(\"user \" + user.getUsername() + \" not in this manager\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return manager.updatePassword(user, newPassword);\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().endsWith(\"does not exist\")) {\n        // create the user or surface a friendly not-found error\n    } else { throw e; }\n}","preventionTips":["Only pass UserDetails obtained from the same manager instance","Normalize usernames (trim/lowercase) before manager calls","Check userExists before update/delete operations on user data","Avoid mixing multiple UserDetailsService implementations over the same users"],"tags":["user-not-found","in-memory-users","runtime-exception","userdetails"],"backgroundTag":"user-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}