{"record":{"id":"b95376f8c5a4e5d2","repo":"spring-projects/spring-security","slug":"unsupported-implementation-of-sid","errorCode":null,"errorMessage":"Unsupported implementation of Sid","messagePattern":"Unsupported implementation of Sid","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java","lineNumber":243,"sourceCode":"\t * Retrieves the primary key from acl_sid, creating a new row if needed and the\n\t * allowCreate property is true.\n\t * @param sid to find or create\n\t * @param allowCreate true if creation is permitted if not found\n\t * @return the primary key or null if not found\n\t * @throws IllegalArgumentException if the <tt>Sid</tt> is not a recognized\n\t * implementation.\n\t */\n\tprotected @Nullable Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {\n\t\tAssert.notNull(sid, \"Sid required\");\n\t\tif (sid instanceof PrincipalSid) {\n\t\t\tString sidName = ((PrincipalSid) sid).getPrincipal();\n\t\t\treturn createOrRetrieveSidPrimaryKey(sidName, true, allowCreate);\n\t\t}\n\t\tif (sid instanceof GrantedAuthoritySid) {\n\t\t\tString sidName = ((GrantedAuthoritySid) sid).getGrantedAuthority();\n\t\t\treturn createOrRetrieveSidPrimaryKey(sidName, false, allowCreate);\n\t\t}\n\t\tthrow new IllegalArgumentException(\"Unsupported implementation of Sid\");\n\t}\n\n\t/**\n\t * Retrieves the primary key from acl_sid, creating a new row if needed and the\n\t * allowCreate property is true.\n\t * @param sidName name of Sid to find or to create\n\t * @param sidIsPrincipal whether it's a user or granted authority like role\n\t * @param allowCreate true if creation is permitted if not found\n\t * @return the primary key or null if not found\n\t */\n\tprotected @Nullable Long createOrRetrieveSidPrimaryKey(String sidName, boolean sidIsPrincipal,\n\t\t\tboolean allowCreate) {\n\t\tList<@Nullable Long> sidIds = this.jdbcOperations.queryForList(this.selectSidPrimaryKey, Long.class,\n\t\t\t\tsidIsPrincipal, sidName);\n\t\tif (!sidIds.isEmpty()) {\n\t\t\tLong result = sidIds.get(0);\n\t\t\tif (result != null) {\n\t\t\t\treturn result;","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java#L225-L261","documentation":"JdbcMutableAclService.createOrRetrieveSidPrimaryKey maps a Sid to its acl_sid row and only understands two Sid implementations: PrincipalSid and GrantedAuthoritySid. Any other Sid subclass reaches the final statement and throws IllegalArgumentException(\"Unsupported implementation of Sid\"). Sid is an interface, so custom implementations are not supported by the JDBC service.","triggerScenarios":"Passing a custom class implementing Sid (not PrincipalSid/GrantedAuthoritySid) to createAcl, updateAcl (owner or ACE sid), insertAce, or any path that resolves sid primary keys (sidPrimaryKey, sidId, ownerSid).","commonSituations":"Implementing the Sid interface for a custom principal type and using it as ACL owner or ACE recipient; wrapping sids in a decorator; a library version where a third-party Sid implementation is passed in; confusing Authentication objects with Sid objects.","solutions":["Convert custom sids to PrincipalSid (for users) or GrantedAuthoritySid (for roles) before passing them to ACL service methods.","Derive sids via SidRetrievalStrategy (e.g. SidRetrievalStrategyImpl) which returns only supported implementations.","If a custom Sid must be supported, subclass or patch the service (override createOrRetrieveSidPrimaryKey) — standard JdbcMutableAclService cannot handle it.","Log/inspect the runtime class of the Sid being passed to find where the unsupported implementation originates."],"exampleFix":"// before\nacl.insertAce(aceOrder, permission, new CustomSid(user), true);\n// after\nSid sid = new PrincipalSid(user); // or new GrantedAuthoritySid(role)\nacl.insertAce(aceOrder, permission, sid, true);\nmutableAclService.updateAcl(acl);","handlingStrategy":"validation","validationCode":"if (!(sid instanceof PrincipalSid) && !(sid instanceof GrantedAuthoritySid)) {\n    throw new IllegalArgumentException(\"Sid must be PrincipalSid or GrantedAuthoritySid\");\n}","typeGuard":"boolean isSupportedSid(Sid s) {\n    return s instanceof PrincipalSid || s instanceof GrantedAuthoritySid;\n}","tryCatchPattern":"null","preventionTips":["Only use PrincipalSid and GrantedAuthoritySid with JDBC ACL services","Derive sids from SidRetrievalStrategyImpl rather than building custom implementations","Assert sid types in service-layer wrappers before touching the ACL API"],"tags":["spring-security","acl","illegal-argument","sid"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}