spring-projects/spring-security · error · IllegalArgumentException

credentials cannot be null

Error message

credentials cannot be null

What it means

authenticate() casts the incoming authentication to UsernamePasswordAuthenticationToken and reads its credentials for the JAAS login. It throws IllegalArgumentException when credentials are null because a Kerberos login cannot proceed without a password.

Source

Thrown at kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java:52

 */
public class KerberosAuthenticationProvider implements AuthenticationProvider {

	private @Nullable KerberosClient kerberosClient;

	private @Nullable UserDetailsService userDetailsService;

	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
		if (this.kerberosClient == null) {
			throw new IllegalStateException("kerberosClient must be set");
		}
		if (this.userDetailsService == null) {
			throw new IllegalStateException("userDetailsService must be set");
		}
		Object credentials = auth.getCredentials();
		if (credentials == null) {
			throw new IllegalArgumentException("credentials cannot be null");
		}
		JaasSubjectHolder subjectHolder = this.kerberosClient.login(auth.getName(), credentials.toString());
		String username = subjectHolder.getUsername();
		if (username == null) {
			throw new IllegalStateException("username cannot be null");
		}
		UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
		KerberosUsernamePasswordAuthenticationToken output = new KerberosUsernamePasswordAuthenticationToken(
				userDetails, credentials, userDetails.getAuthorities(), subjectHolder);
		output.setDetails(authentication.getDetails());
		return output;

	}

	@Override
	public boolean supports(Class<? extends Object> authentication) {
		return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure the client always sends a non-null password with the username.
2. Add form/input validation rejecting empty passwords before reaching AuthenticationManager.
3. Route Kerberos SSO (token-based) requests to KerberosServiceAuthenticationProvider instead of KerberosAuthenticationProvider.
4. Pre-check `authentication.getCredentials() != null` before invoking the manager.

Example fix

// before
new UsernamePasswordAuthenticationToken(user, null);
// after
new UsernamePasswordAuthenticationToken(user, password);

if (auth instanceof UsernamePasswordAuthenticationToken t && t.getCredentials() == null) {
  throw new BadCredentialsException("Password required");
}

try {
  return authenticationManager.authenticate(auth);
} catch (IllegalArgumentException e) {
  LOG.warn("Login rejected: no credentials supplied");
  throw new BadCredentialsException("Missing credentials", e);
}

When it happens

Trigger: Submitting a UsernamePasswordAuthenticationToken with a null credentials value (e.g. an anonymous/empty login form submission or a token constructed programmatically without a password).

Common situations: Login forms posting an empty password, API clients building the token without a password field, or SSO flows mistakenly routed through the username/password provider.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Unknown Callback
• Kerberos authentication failed
• Negotiate Header was invalid: %s
• RunAsImplAuthenticationProvider.incorrectKey
• Authenticated principal required to operate with ACLs

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d139a40f933c1d35. Report an issue: GitHub.