spring-projects/spring-security · error · IllegalArgumentException

Invalid object type: {value.getClass().getName()}

Error message

Invalid object type: {value.getClass().getName()}

What it means

MapBasedAttributes2GrantedAuthoritiesMapper converts user attribute values into GrantedAuthority instances. Its per-element conversion accepts String, Collection, or GrantedAuthority; any other object type hits the else branch and throws IllegalArgumentException naming the offending class.

Source

Thrown at core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java:143

	 */
	private void addGrantedAuthorityCollection(Collection<GrantedAuthority> result, @Nullable Object value) {
		if (value == null) {
			return;
		}
		if (value instanceof Collection<?>) {
			addGrantedAuthorityCollection(result, (Collection<?>) value);
		}
		else if (value instanceof Object[]) {
			addGrantedAuthorityCollection(result, (Object[]) value);
		}
		else if (value instanceof String) {
			addGrantedAuthorityCollection(result, (String) value);
		}
		else if (value instanceof GrantedAuthority) {
			result.add((GrantedAuthority) value);
		}
		else {
			throw new IllegalArgumentException("Invalid object type: " + value.getClass().getName());
		}
	}

	private void addGrantedAuthorityCollection(Collection<GrantedAuthority> result, Collection<?> value) {
		for (Object elt : value) {
			addGrantedAuthorityCollection(result, elt);
		}
	}

	private void addGrantedAuthorityCollection(Collection<GrantedAuthority> result, Object[] value) {
		for (Object aValue : value) {
			addGrantedAuthorityCollection(result, aValue);
		}
	}

	private void addGrantedAuthorityCollection(Collection<GrantedAuthority> result, String value) {
		StringTokenizer tokenizer = new StringTokenizer(value, this.stringSeparator, false);
		while (tokenizer.hasMoreTokens()) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Convert non-string attribute values to String (e.g. String.valueOf(value)) before mapping
2. Ensure collection values contain only strings/GrantedAuthorities — flatten or stringify nested collections
3. Add a custom Attributes2GrantedAuthoritiesMapper implementation that handles your value types

Example fix

// before
Map<String, Object> attrs = Map.of("role", 42);
mapper.getGrantedAuthorities(attrs);
// after
Map<String, Object> attrs = Map.of("role", String.valueOf(42));
mapper.getGrantedAuthorities(attrs);

Object v = attrs.get("role"); if (!(v instanceof String || v instanceof GrantedAuthority || v instanceof Collection)) throw new IllegalArgumentException("unsupported attribute type: " + v.getClass());

boolean mappable(Object v) { return v instanceof String || v instanceof GrantedAuthority || v instanceof Collection<?>; }

try { authorities = mapper.getGrantedAuthorities(attrs); } catch (IllegalArgumentException ex) { authorities = List.of(); }

When it happens

Trigger: Calling getGrantedAuthorityCollection/addGrantedAuthorityCollection with an attribute map whose values (or elements inside a collection value) are not String, Collection, or GrantedAuthority — e.g. Integer, Boolean, or a nested List of numbers from an LDAP/DB attribute source.

Common situations: Mapping directory attributes (like memberOf returning non-string objects) to authorities; passing raw numbers from a database role column; supplying a List<List<String>> nested structure.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• WebAttributes.APPLICATION_CONTEXT_ATTRIBUTE value must be of
• Unsupported implementation of Sid
• Cannot pass null or empty values to constructor
• Can not set rememberMeCookieName and custom rememberMeServic
• Filter target must be a collection, array, map or stream typ

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/89db421735404ed0. Report an issue: GitHub.