{"record":{"id":"e4bd8fb7ecf04a03","repo":"spring-projects/spring-security","slug":"jdbcdaoimpl-notfound","errorCode":"JdbcDaoImpl.notFound","errorMessage":"Username {0} not found","messagePattern":"Username (.+?) not found","errorType":"exception","errorClass":"UsernameNotFoundException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/core/userdetails/jdbc/JdbcDaoImpl.java","lineNumber":189,"sourceCode":"\tprotected void addCustomAuthorities(String username, List<GrantedAuthority> authorities) {\n\t}\n\n\tpublic String getUsersByUsernameQuery() {\n\t\treturn this.usersByUsernameQuery;\n\t}\n\n\t@Override\n\tprotected void initDao() throws ApplicationContextException {\n\t\tAssert.isTrue(this.enableAuthorities || this.enableGroups,\n\t\t\t\t\"Use of either authorities or groups must be enabled\");\n\t}\n\n\t@Override\n\tpublic UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n\t\tList<UserDetails> users = loadUsersByUsername(username);\n\t\tif (users.isEmpty()) {\n\t\t\tthis.logger.debug(\"Query returned no results for user '\" + username + \"'\");\n\t\t\tthrow new UsernameNotFoundException(this.messages.getMessage(\"JdbcDaoImpl.notFound\",\n\t\t\t\t\tnew Object[] { username }, \"Username {0} not found\"));\n\t\t}\n\t\tUserDetails user = users.get(0); // contains no GrantedAuthority[]\n\t\tSet<GrantedAuthority> dbAuthsSet = new HashSet<>();\n\t\tif (this.enableAuthorities) {\n\t\t\tdbAuthsSet.addAll(loadUserAuthorities(user.getUsername()));\n\t\t}\n\t\tif (this.enableGroups) {\n\t\t\tdbAuthsSet.addAll(loadGroupAuthorities(user.getUsername()));\n\t\t}\n\t\tList<GrantedAuthority> dbAuths = new ArrayList<>(dbAuthsSet);\n\t\taddCustomAuthorities(user.getUsername(), dbAuths);\n\t\tif (dbAuths.isEmpty()) {\n\t\t\tthis.logger.debug(\"User '\" + username + \"' has no authorities and will be treated as 'not found'\");\n\t\t\tthrow new UsernameNotFoundException(this.messages.getMessage(\"JdbcDaoImpl.noAuthority\",\n\t\t\t\t\tnew Object[] { username }, \"User {0} has no GrantedAuthority\"));\n\t\t}\n\t\treturn createUserDetails(username, user, dbAuths);","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/core/userdetails/jdbc/JdbcDaoImpl.java#L171-L207","documentation":"JdbcDaoImpl.loadUserByUsername throws UsernameNotFoundException when the configured users-by-username query returns no rows. The message is resolved from the message source key 'JdbcDaoImpl.notFound' with the username substituted, and Spring Security by default hides the real cause (user vs password mismatch) for security reasons.","triggerScenarios":"Calling loadUserByUsername with a username that does not exist in the users table, when the usersByUsernameQuery finds no matching rows.","commonSituations":"Typo in username, wrong case sensitivity with case-sensitive DB collation, querying the wrong database/schema, users table not seeded in a fresh environment, JDBC DataSource pointing at a different environment.","solutions":["Verify the username exists in the DB by running the configured usersByUsernameQuery manually against the same DataSource","Check DataSource configuration (JDBC URL, schema, environment) — a common cause is pointing at an empty or wrong database","Handle case sensitivity: use lower(username)=lower(?) in the query or ensure consistent casing","Seed the user data if this is a fresh deployment"],"exampleFix":"// before\nusersByUsernameQuery=select username,password,enabled from users where username = ?\n// after (case-insensitive)\nusersByUsernameQuery=select username,password,enabled from users where lower(username) = lower(?)","handlingStrategy":"try-catch","validationCode":"Long count = jdbc.queryForObject(usersByUsernameQuery, Long.class, username); if (count == null || count == 0) { /* user absent — handle before load */ }","typeGuard":null,"tryCatchPattern":"try { user = dao.loadUserByUsername(username); } catch (UsernameNotFoundException ex) { throw new BadCredentialsException(\"Bad credentials\"); }","preventionTips":["Verify the configured query manually against the same DataSource","Check DataSource URL/schema/environment before debugging auth","Handle case sensitivity in username matching","Seed user data in fresh environments","Keep UsernameNotFoundException mapped to generic 'bad credentials' responses"],"tags":["user-not-found","jdbc","authentication"],"backgroundTag":"user-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}