spring-projects/spring-security · error · RuntimeException

Error while invoking method <methodClass>.<methodName>(<args

Error message

Error while invoking method <methodClass>.<methodName>(<args>)

What it means

invokeMethod wraps reflective Method.invoke calls used to access WebSphere internal APIs (WSSubject, WASCredential, etc.). If the reflection call fails with IllegalArgumentException, IllegalAccessException, or InvocationTargetException, the exception is logged and rethrown as a RuntimeException whose message includes the target class, method and argument list. This indicates the WebSphere runtime API could not be invoked as expected.

Source

Thrown at web/src/main/java/org/springframework/security/web/authentication/preauth/websphere/DefaultWASUsernameAndGroupsExtractor.java:163

		try {
			if (context != null) {
				context.close();
			}
		}
		catch (NamingException ex) {
			logger.debug("Exception occurred while closing context", ex);
		}
	}

	private static Object invokeMethod(Method method, @Nullable Object instance, Object... args) {
		try {
			return method.invoke(instance, args);
		}
		catch (IllegalArgumentException | IllegalAccessException | InvocationTargetException ex) {
			String message = "Error while invoking method " + method.getClass().getName() + "." + method.getName() + "("
					+ Arrays.asList(args) + ")";
			logger.error(message, ex);
			throw new RuntimeException(message, ex);
		}
	}

	private static Method getMethod(String className, String methodName, String[] parameterTypeNames) {
		try {
			Class<?> c = Class.forName(className);
			int len = parameterTypeNames.length;
			Class<?>[] parameterTypes = new Class[len];
			for (int i = 0; i < len; i++) {
				parameterTypes[i] = Class.forName(parameterTypeNames[i]);
			}
			return c.getDeclaredMethod(methodName, parameterTypes);
		}
		catch (ClassNotFoundException ex) {
			logger.error("Required class" + className + " not found");
			throw new RuntimeException("Required class" + className + " not found", ex);
		}
		catch (NoSuchMethodException ex) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Read the cause chain: for InvocationTargetException, unwrap ex.getCause() to see the real WAS-side failure.
2. Verify the WebSphere version matches the API signatures this extractor was built against; upgrade spring-security-web or adjust for your WAS release.
3. Ensure the code runs inside the WAS container with a valid WSSubject/RunAs subject present (e.g. inside an authenticated request thread).
4. Check for a SecurityManager or classloader restriction blocking access to the method; relax setAccessible or run the call in a privileged block.
5. If arguments were supplied programmatically, validate their types match the declared parameter types before invoking.

Example fix

// before
String name = extractor.getSecurityName(subject);
// after
String name;
try {
    name = extractor.getSecurityName(subject);
} catch (RuntimeException ex) {
    logger.error("WAS reflection invoke failed: " + ex.getCause(), ex);
    throw new AuthenticationServiceException("WebSphere security name lookup failed", ex);
}

// confirm the WAS API method exists before invoking reflectively
try {
    Class.forName("com.ibm.websphere.security.auth.WSSubject");
} catch (ClassNotFoundException e) {
    throw new IllegalStateException("WebSphere runtime not present");
}

try {
    String name = extractor.getSecurityName(subject);
} catch (RuntimeException ex) {
    // InvocationTargetException: unwrap ex.getCause() for the WAS-side error
    // IllegalArgument/IllegalAccess: signature or access problem
    logger.error("WAS reflective invoke failed: " + ex.getMessage(), ex.getCause());
    throw new AuthenticationServiceException("WebSphere security lookup failed", ex);
}

When it happens

Trigger: Any reflective invocation made by getSecurityName, getRunAsSubject, userReg, or groups when: the target method itself throws (InvocationTargetException - e.g. WAS internal error), the method is inaccessible (IllegalAccessException - non-public on a restricted classloader), or the argument types/values do not match the method signature (IllegalArgumentException).

Common situations: Running on a WebSphere version where the internal API changed signature; invoking with a null/incorrectly-typed subject or credential; calling a private method without setAccessible success under a restrictive SecurityManager; WAS fixpack altering internal class behavior.

Related errors

• Exception occurred while looking up groups for user
• Required class<className> not found
• Required class <className> not found
• user '{username}' does not exist
• Could not locate field 'X' on class Y

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/efc2401f5d5d1a1f. Report an issue: GitHub.