{"record":{"id":"d7b122c507e3a326","repo":"spring-projects/spring-security","slug":"error-running-rest-call","errorCode":null,"errorMessage":"Error running rest call","messagePattern":"Error running rest call","errorType":"http","errorClass":"RestClientException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java","lineNumber":255,"sourceCode":"\t\ttry {\n\t\t\tLoginContext lc = buildLoginContext();\n\t\t\tlc.login();\n\t\t\tSubject serviceSubject = lc.getSubject();\n\t\t\treturn Subject.doAs(serviceSubject, new PrivilegedAction<T>() {\n\n\t\t\t\t@Override\n\t\t\t\tpublic T run() {\n\t\t\t\t\treturn KerberosRestTemplate.this.doExecuteSubject(url, uriTemplate, method, requestCallback,\n\t\t\t\t\t\t\tresponseExtractor);\n\t\t\t\t}\n\t\t\t});\n\n\t\t}\n\t\tcatch (RestClientException ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new RestClientException(\"Error running rest call\", ex);\n\t\t}\n\t}\n\n\tprivate <T> T doExecuteSubject(URI url, @Nullable String uriTemplate, @Nullable HttpMethod method,\n\t\t\t@Nullable RequestCallback requestCallback, @Nullable ResponseExtractor<T> responseExtractor)\n\t\t\tthrows RestClientException {\n\t\tT result = super.doExecute(url, uriTemplate, method, requestCallback, responseExtractor);\n\t\tif (result == null) {\n\t\t\tthrow new RestClientException(\"doExecute returned null\");\n\t\t}\n\t\treturn result;\n\t}\n\n\tprivate static final class ClientLoginConfig extends Configuration {\n\n\t\tprivate final @Nullable String keyTabLocation;\n\n\t\tprivate final @Nullable String userPrincipal;","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java#L237-L273","documentation":"KerberosRestTemplate overrides RestTemplate's doExecute to add SPNEGO/Kerberos authentication. Any non-RestClientException exception thrown during execution (I/O errors, GSS/Kerberos login problems, etc.) is wrapped in a RestClientException with the message 'Error running rest call' and the original cause attached, so callers get a single, uniform exception type.","triggerScenarios":"Any request executed through KerberosRestTemplate (getForObject, exchange, etc.) where an underlying call throws a checked/unexpected Exception not already a RestClientException — e.g. GSSException during the Kerberos handshake or IOException from the connection.","commonSituations":"Expired or missing Kerberos ticket/keytab causing GSS-API failures; misconfigured service principal (spnego service name); network interruptions mid-call; users inspecting the message and forgetting to check getCause().","solutions":["Inspect the cause via ex.getCause() to find the real Kerberos/IO failure and fix it.","Verify the Kerberos setup: valid keytab, kinit'ed subject, correct service principal and JAAS config.","Enable GSS/debug logging (sun.security.jgss.debug=true) to pinpoint the handshake stage that failed."],"exampleFix":"// before\ntry { template.getForObject(url, String.class); } catch (RestClientException e) { log.error(e.getMessage()); }\n// after\ntry { template.getForObject(url, String.class); }\ncatch (RestClientException e) {\n    log.error(\"REST call failed\", e.getCause()); // inspect real cause\n    if (e.getCause() instanceof GSSException) { reestablishTicket(); }\n}","handlingStrategy":"try-catch","validationCode":"// preflight: ensure a fresh Kerberos ticket before calling\ntry (LoginContext lc = new LoginContext(\"KrbLogin\")) { lc.login(); }","typeGuard":null,"tryCatchPattern":"try {\n    return template.getForObject(url, String.class);\n} catch (RestClientException e) {\n    Throwable cause = e.getCause();\n    if (cause instanceof GSSException || cause instanceof IOException) {\n        // re-authenticate / retry with backoff\n    }\n    throw e;\n}","preventionTips":["Always inspect getCause(), not just the message.","Keep keytabs/tickets refreshed (kinit or keytab login).","Validate the service principal and JAAS config in staging.","Enable sun.security.jgss.debug when diagnosing."],"tags":["java","kerberos","resttemplate","spnego","network"],"backgroundTag":"http-request-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}