What causes "doExecute returned null" in spring-projects/spring-security?

Fix the ResponseExtractor to never return null (return an empty object/empty collection instead).

spring-projects/spring-security · error · RestClientException

doExecute returned null

Error message

doExecute returned null

What it means

doExecuteSubject calls RestTemplate's doExecute and asserts the result is non-null before returning it. Since KerberosRestTemplate always uses a ResponseExtractor, a null result would indicate an unexpected/failed extraction, so it throws RestClientException('doExecute returned null') to keep the return contract of T non-null.

Source

Thrown at kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java:264

							responseExtractor);
				}
			});

		}
		catch (RestClientException ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new RestClientException("Error running rest call", ex);
		}
	}

	private <T> T doExecuteSubject(URI url, @Nullable String uriTemplate, @Nullable HttpMethod method,
			@Nullable RequestCallback requestCallback, @Nullable ResponseExtractor<T> responseExtractor)
			throws RestClientException {
		T result = super.doExecute(url, uriTemplate, method, requestCallback, responseExtractor);
		if (result == null) {
			throw new RestClientException("doExecute returned null");
		}
		return result;
	}

	private static final class ClientLoginConfig extends Configuration {

		private final @Nullable String keyTabLocation;

		private final @Nullable String userPrincipal;

		private final @Nullable String password;

		private final @Nullable Map<String, Object> loginOptions;

		private ClientLoginConfig(@Nullable String keyTabLocation, @Nullable String userPrincipal,
				@Nullable String password, @Nullable Map<String, Object> loginOptions) {
			super();
			this.keyTabLocation = keyTabLocation;

View on GitHub (pinned to 96852e8860)

Solutions

Fix the ResponseExtractor to never return null (return an empty object/empty collection instead).
Wrap the call in try-catch and substitute a default value when this RestClientException is thrown.
Use built-in extractors (e.g. getForObject) rather than a hand-written one that can return null.

Example fix

// before
public String extractData(ClientHttpResponse r) { parse(r); } // returns null
// after
public String extractData(ClientHttpResponse r) { return parse(r); }

Defensive patterns

Strategy: try-catch

Try / catch

try {
    return template.execute(url, HttpMethod.GET, null, extractor);
} catch (RestClientException e) {
    if ("doExecute returned null".equals(e.getMessage())) {
        return defaultValue; // extractor produced null
    }
    throw e;
}

Prevention

Never return null from ResponseExtractor.extractData; return empty collections/objects.
Unit-test custom extractors against empty response bodies.
Prefer built-in conversion (getForObject) over hand-rolled extractors.

When it happens

Trigger: Executing a request via KerberosRestTemplate where super.doExecute returns null — typically when the supplied ResponseExtractor.extractData returns null or no extractor produced a value.

Common situations: Custom ResponseExtractor implementations that return null on empty bodies; extractors that forget to return the parsed value on some code path.

Understand the failure class

Background: "empty response", "returned no data", "empty embeddings": what HTTP 200-with-empty-body errors mean across libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8a7d4ce25a566372. Report an issue: GitHub.