What causes "Cannot pass null or empty values to constructor" in spring-projects/spring-security?

Ensure every argument is non-null and non-empty before constructing the token, especially credentials and assertion.

spring-projects/spring-security · error · IllegalArgumentException

Cannot pass null or empty values to constructor

Error message

Cannot pass null or empty values to constructor

What it means

The private CasAuthenticationToken constructor validates its inputs and throws IllegalArgumentException if principal, credentials, authorities, userDetails, or assertion is null or equals the empty string. This is an internal invariant guard ensuring a fully-populated CAS authentication token; the public constructor also checks that the key hash matches before delegating here.

Source

Thrown at cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationToken.java:98

	 * <code>null</code>)
	 * @param authorities the authorities granted to the user (from the
	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
	 * be <code>null</code>)
	 * @param userDetails the user details (from the
	 * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot
	 * be <code>null</code>)
	 * @param assertion the assertion returned from the CAS servers. It contains the
	 * principal and how to obtain a proxy ticket for the user.
	 * @throws IllegalArgumentException if a <code>null</code> was passed
	 * @since 4.2
	 */
	private CasAuthenticationToken(final Integer keyHash, final Object principal, final Object credentials,
			final Collection<? extends GrantedAuthority> authorities, final UserDetails userDetails,
			final Assertion assertion) {
		super(authorities);
		if ((principal == null) || "".equals(principal) || (credentials == null) || "".equals(credentials)
				|| (authorities == null) || (userDetails == null) || (assertion == null)) {
			throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
		}
		this.keyHash = keyHash;
		this.principal = principal;
		this.credentials = credentials;
		this.userDetails = userDetails;
		this.assertion = assertion;
		setAuthenticated(true);
	}

	protected CasAuthenticationToken(Builder<?> builder) {
		super(builder);
		Assert.isTrue(!"".equals(builder.principal), "principal cannot be null or empty");
		Assert.isTrue(!"".equals(builder.credentials), "credentials cannot be null or empty");
		Assert.notNull(builder.userDetails, "userDetails cannot be null");
		Assert.notNull(builder.assertion, "assertion cannot be null");
		this.keyHash = builder.keyHash;
		this.principal = builder.principal;
		this.credentials = builder.credentials;

View on GitHub (pinned to 96852e8860)

Solutions

Ensure every argument is non-null and non-empty before constructing the token, especially credentials and assertion.
When faking tokens in tests, use a real or mocked Assertion instance and non-empty credentials.
Check the key hash too: the public constructor throws BadCredentialsException if key.hashCode() != keyHash, a separate common failure.
If principal may legitimately be empty, wrap or substitute an anonymous UserDetails instead of "".

Example fix

// before
new CasAuthenticationToken(key, principal, "", authorities, userDetails, null);
// after
Assert.notNull(assertion, "assertion required");
new CasAuthenticationToken(key, principal, credentials, authorities, userDetails, assertion); // all args non-null/non-empty

Defensive patterns

Strategy: validation

Validate before calling

if (principal == null || "".equals(principal) || credentials == null || "".equals(credentials)
        || authorities == null || userDetails == null || assertion == null) {
    throw new IllegalArgumentException("all CasAuthenticationToken arguments must be non-null and non-empty");
}

Try / catch

try {
    new CasAuthenticationToken(key, principal, credentials, authorities, userDetails, assertion);
} catch (IllegalArgumentException e) {
    log.error("Invalid CAS token args: check credentials/assertion are populated", e);
}

Prevention

Always build tokens with a real Assertion instance
Validate inputs before constructing authentication tokens
Remember the public constructor also checks key hash: use key.hashCode()
In tests, use factory helpers to create fully populated tokens

When it happens

Trigger: Calling new CasAuthenticationToken(key, principal, credentials, authorities, userDetails, assertion) with any null/empty argument, or building the token programmatically (e.g. in tests or a custom provider) with an empty credentials string or null assertion.

Common situations: Custom authentication providers or tests constructing CasAuthenticationToken directly without a valid Assertion; migrating code that previously passed null credentials; reflection-based test helpers missing fields.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/22ebb67121c43192. Report an issue: GitHub.