pinpoint-apm/pinpoint · error · AuthenticationCredentialsNotFoundException

SecurityContext not found th:

Error message

SecurityContext not found th:

What it means

SecurityContextUtils.getSecurityContext obtains the SecurityContext via the configured STRATEGY (SecurityContextHolder strategy) and throws AuthenticationCredentialsNotFoundException when it is null, including the thread name to aid debugging. Methods like context() rely on this, so any user-info lookup without an authenticated request fails here.

Solutions

1. Ensure the code runs within an authenticated request or set a SecurityContext for the thread (SecurityContextHolder.setContext or DelegatingSecurityContextRunnable).
2. Catch AuthenticationCredentialsNotFoundException and fall back to anonymous handling.
3. Wrap async work with DelegatingSecurityContextExecutor to propagate the context.

Example fix

// before
String userId = SecurityContextUtils.context().getAuthentication().getName(); // in async task
// after
Runnable wrapped = new DelegatingSecurityContextRunnable(() -> {
    String userId = SecurityContextUtils.context().getAuthentication().getName();
}, securityContext);

SecurityContext ctx = SecurityContextHolder.getContext();
boolean hasAuth = ctx != null && ctx.getAuthentication() != null && ctx.getAuthentication().isAuthenticated();

boolean hasSecurityContext(SecurityContext c) { return c != null && c.getAuthentication() != null; }

try { SecurityContext ctx = SecurityContextUtils.context(); ... } catch (AuthenticationCredentialsNotFoundException e) { /* anonymous fallback or defer */ }

When it happens

Trigger: Calling SecurityContextUtils.context()/helpers on a thread where no SecurityContext was ever set — unauthenticated requests, async worker threads, or code paths that skip the security filter chain.

Common situations: Background jobs or scheduled tasks accessing user info; requests to endpoints excluded from Spring Security; tests without a mock security context; thread-pool reuse after context clearing.

Related errors

• There is not userId or fail to create userGroup.
• Authorization Error
• Could not load User information.
• User not found:

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/3b6099fd6ca37f51. Report an issue: GitHub.

Appendix: source

Thrown at user/src/main/java/com/navercorp/pinpoint/user/util/SecurityContextUtils.java:108

    }

    public static <T extends Authentication> T getAuthentication(Class<T> clazz) {
        final SecurityContext context = getSecurityContext();
        final Authentication authentication = context.getAuthentication();
        if (clazz.isInstance(authentication)) {
            return cast(authentication);
        }
        return null;
    }

    private static String getThreadName() {
        return Thread.currentThread().getName();
    }

    private static SecurityContext getSecurityContext() {
        final SecurityContext context = STRATEGY.getContext();
        if (context == null) {
            throw new AuthenticationCredentialsNotFoundException("SecurityContext not found th:" + getThreadName());
        }
        return context;
    }
}

View on GitHub (pinned to 744c3d3075)