{"record":{"id":"f93f028d44a93a27","repo":"spring-projects/spring-security","slug":"failed-to-obtain-dircontext","errorCode":null,"errorMessage":"Failed to obtain DirContext","messagePattern":"Failed to obtain DirContext","errorType":"exception","errorClass":"NamingException","httpStatus":null,"severity":"error","filePath":"kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/ldap/KerberosLdapContextSource.java","lineNumber":131,"sourceCode":"\t\tDirContext dirContext = Subject.doAs(serviceSubject, new PrivilegedAction<@Nullable DirContext>() {\n\n\t\t\t@Override\n\t\t\tpublic @Nullable DirContext run() {\n\t\t\t\ttry {\n\t\t\t\t\treturn KerberosLdapContextSource.super.getDirContextInstance(environment);\n\t\t\t\t}\n\t\t\t\tcatch (NamingException ex) {\n\t\t\t\t\tsuppressedException[0] = ex;\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\n\t\tif (suppressedException[0] != null) {\n\t\t\tthrow suppressedException[0];\n\t\t}\n\t\tif (dirContext == null) {\n\t\t\tthrow new NamingException(\"Failed to obtain DirContext\");\n\t\t}\n\n\t\treturn dirContext;\n\t}\n\n\t/**\n\t * The login configuration to get the serviceSubject from LoginContext.\n\t * @param loginConfig the login config\n\t */\n\tpublic void setLoginConfig(Configuration loginConfig) {\n\t\tthis.loginConfig = loginConfig;\n\t}\n\n\tprivate Subject login() throws AuthenticationException {\n\t\ttry {\n\t\t\tLoginContext lc = new LoginContext(KerberosLdapContextSource.class.getSimpleName(), null, null,\n\t\t\t\t\tthis.loginConfig);\n","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/ldap/KerberosLdapContextSource.java#L113-L149","documentation":"KerberosLdapContextSource.getDirContextInstance collects any exception thrown while creating the LDAP DirContext and rethrows it; if creation fails silently and no context is produced, it throws this NamingException. It means the library could not establish an LDAP directory context (typically the Active Directory/LDAP server the Kerberos setup points at).","triggerScenarios":"Calling getDirContextInstance when the underlying context factory returns null after a suppressed failure — e.g. unreachable LDAP URL, failed SPN/service-account authentication, or DNS resolution failure for the domain controller.","commonSituations":"Spring Security Kerberos clients wiring KerberosLdapContextSource as the UserDetailsService: wrong ldapUrls, domain not resolvable, firewall blocking port 389/636, or misconfigured service account credentials.","solutions":["Verify the LDAP URL(s) are reachable from the app host (e.g. `nc -vz ldap://dc.example.com 389`).","Check the baseEnvironmentProperties and authentication credentials/SPN configured on the context source.","Confirm DNS resolves the AD domain controller and searchBase is correct.","Inspect the suppressed exception logged by the context creation to find the root cause (connect/auth failure).","If using ldaps, ensure the CA certificate is in the truststore."],"exampleFix":"// before\nKerberosLdapContextSource ctx = new KerberosLdapContextSource();\nctx.setUrls(\"ldap://wrong-host:389\");\n// after\nKerberosLdapContextSource ctx = new KerberosLdapContextSource();\nctx.setUrls(\"ldap://dc1.example.com:389\");\nctx.setSearchBase(\"dc=example,dc=com\");\nctx.afterPropertiesSet();","handlingStrategy":"validation","validationCode":"if (ctx.getUrls() == null || ctx.getUrls().isEmpty()) throw new IllegalStateException(\"LDAP urls not configured\");\n// verify reachability first\ntry (Socket s = new Socket(host, port)) { /* reachable */ } catch (IOException e) { /* fail fast */ }","typeGuard":null,"tryCatchPattern":"try {\n  DirContext dc = kerberosLdapContextSource.getDirContextInstance(...);\n} catch (NamingException e) {\n  LOG.error(\"LDAP context creation failed; check LDAP URL/credentials/DNS\", e);\n  throw new AuthenticationServiceException(\"Directory unavailable\", e);\n}","preventionTips":["Smoke-test LDAP connectivity from the app host before deploy.","Keep searchBase and URLs in externalized, validated configuration.","Monitor the suppressed exception detail logged by the context source."],"tags":["ldap","kerberos","directory-services","network"],"backgroundTag":"connection-refused","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}