{"record":{"id":"d139a40f933c1d35","repo":"spring-projects/spring-security","slug":"credentials-cannot-be-null","errorCode":null,"errorMessage":"credentials cannot be null","messagePattern":"credentials cannot be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java","lineNumber":52,"sourceCode":" */\npublic class KerberosAuthenticationProvider implements AuthenticationProvider {\n\n\tprivate @Nullable KerberosClient kerberosClient;\n\n\tprivate @Nullable UserDetailsService userDetailsService;\n\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tUsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;\n\t\tif (this.kerberosClient == null) {\n\t\t\tthrow new IllegalStateException(\"kerberosClient must be set\");\n\t\t}\n\t\tif (this.userDetailsService == null) {\n\t\t\tthrow new IllegalStateException(\"userDetailsService must be set\");\n\t\t}\n\t\tObject credentials = auth.getCredentials();\n\t\tif (credentials == null) {\n\t\t\tthrow new IllegalArgumentException(\"credentials cannot be null\");\n\t\t}\n\t\tJaasSubjectHolder subjectHolder = this.kerberosClient.login(auth.getName(), credentials.toString());\n\t\tString username = subjectHolder.getUsername();\n\t\tif (username == null) {\n\t\t\tthrow new IllegalStateException(\"username cannot be null\");\n\t\t}\n\t\tUserDetails userDetails = this.userDetailsService.loadUserByUsername(username);\n\t\tKerberosUsernamePasswordAuthenticationToken output = new KerberosUsernamePasswordAuthenticationToken(\n\t\t\t\tuserDetails, credentials, userDetails.getAuthorities(), subjectHolder);\n\t\toutput.setDetails(authentication.getDetails());\n\t\treturn output;\n\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<? extends Object> authentication) {\n\t\treturn (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));\n\t}","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java#L34-L70","documentation":"authenticate() casts the incoming authentication to UsernamePasswordAuthenticationToken and reads its credentials for the JAAS login. It throws IllegalArgumentException when credentials are null because a Kerberos login cannot proceed without a password.","triggerScenarios":"Submitting a UsernamePasswordAuthenticationToken with a null credentials value (e.g. an anonymous/empty login form submission or a token constructed programmatically without a password).","commonSituations":"Login forms posting an empty password, API clients building the token without a password field, or SSO flows mistakenly routed through the username/password provider.","solutions":["Ensure the client always sends a non-null password with the username.","Add form/input validation rejecting empty passwords before reaching AuthenticationManager.","Route Kerberos SSO (token-based) requests to KerberosServiceAuthenticationProvider instead of KerberosAuthenticationProvider.","Pre-check `authentication.getCredentials() != null` before invoking the manager."],"exampleFix":"// before\nnew UsernamePasswordAuthenticationToken(user, null);\n// after\nnew UsernamePasswordAuthenticationToken(user, password);","handlingStrategy":"validation","validationCode":"if (auth instanceof UsernamePasswordAuthenticationToken t && t.getCredentials() == null) {\n  throw new BadCredentialsException(\"Password required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  return authenticationManager.authenticate(auth);\n} catch (IllegalArgumentException e) {\n  LOG.warn(\"Login rejected: no credentials supplied\");\n  throw new BadCredentialsException(\"Missing credentials\", e);\n}","preventionTips":["Validate the login form/API payload requires a non-empty password.","Never build UsernamePasswordAuthenticationToken with null credentials for this provider.","Route ticket/SPNEGO traffic to KerberosServiceAuthenticationProvider instead."],"tags":["kerberos","authentication","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}