spring-projects/spring-security · error · UsernameNotFoundException

JdbcDaoImpl.noAuthority

JdbcDaoImpl.noAuthority

Error message

User {0} has no GrantedAuthority

What it means

JdbcDaoImpl.loadUserByUsername throws UsernameNotFoundException with message key 'JdbcDaoImpl.noAuthority' when the user row exists but the combined authorities (from users-by-authorities and, if enabled, group authorities plus any addCustomAuthorities additions) end up empty. By design it is reported as 'not found' so the existence of the user is not leaked.

Source

Thrown at core/src/main/java/org/springframework/security/core/userdetails/jdbc/JdbcDaoImpl.java:204

		List<UserDetails> users = loadUsersByUsername(username);
		if (users.isEmpty()) {
			this.logger.debug("Query returned no results for user '" + username + "'");
			throw new UsernameNotFoundException(this.messages.getMessage("JdbcDaoImpl.notFound",
					new Object[] { username }, "Username {0} not found"));
		}
		UserDetails user = users.get(0); // contains no GrantedAuthority[]
		Set<GrantedAuthority> dbAuthsSet = new HashSet<>();
		if (this.enableAuthorities) {
			dbAuthsSet.addAll(loadUserAuthorities(user.getUsername()));
		}
		if (this.enableGroups) {
			dbAuthsSet.addAll(loadGroupAuthorities(user.getUsername()));
		}
		List<GrantedAuthority> dbAuths = new ArrayList<>(dbAuthsSet);
		addCustomAuthorities(user.getUsername(), dbAuths);
		if (dbAuths.isEmpty()) {
			this.logger.debug("User '" + username + "' has no authorities and will be treated as 'not found'");
			throw new UsernameNotFoundException(this.messages.getMessage("JdbcDaoImpl.noAuthority",
					new Object[] { username }, "User {0} has no GrantedAuthority"));
		}
		return createUserDetails(username, user, dbAuths);
	}

	/**
	 * Executes the SQL <tt>usersByUsernameQuery</tt> and returns a list of UserDetails
	 * objects. There should normally only be one matching user.
	 */
	protected List<UserDetails> loadUsersByUsername(String username) {
		// @formatter:off
		RowMapper<UserDetails> mapper = (rs, rowNum) -> {
			String username1 = rs.getString(1);
			String password = rs.getString(2);
			boolean enabled = rs.getBoolean(3);
			return new User(username1, password, enabled, true, true, true, AuthorityUtils.NO_AUTHORITIES);
		};
		// @formatter:on

View on GitHub (pinned to 96852e8860)

Solutions

1. Check the authoritiesByUsernameQuery returns rows for the user (run it manually with the username)
2. Ensure enableAuthorities is true (default) or enableGroupAuthorities with correct group query if you use groups
3. Seed authority rows for the user in the authorities table
4. Add roles in addCustomAuthorities override if roles come from another source

Example fix

// before
authoritiesByUsernameQuery=select username,rol from authorities where username = ?
// after (correct column name)
authoritiesByUsernameQuery=select username,authority from authorities where username = ?

List<?> auths = jdbc.queryForList(authoritiesByUsernameQuery, username); if (auths.isEmpty()) { /* user exists but has no roles — handle explicitly */ }

try { user = dao.loadUserByUsername(username); } catch (UsernameNotFoundException ex) { // could be missing user OR missing authorities; log and deny }

When it happens

Trigger: User exists in the users table but the authoritiesByUsernameQuery returns no rows and enableAuthorities/enableGroupAuthorities are not configured to pick up roles.

Common situations: Wrong authoritiesByUsernameQuery table/column names, authorities not seeded for the user, enableAuthorities=false without group authorities enabled, custom addCustomAuthorities returning empty list.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• JdbcDaoImpl.notFound
• Can't change password as no Authentication object found in c
• Bad credentials
• RunAsImplAuthenticationProvider.incorrectKey
• Authenticated principal required to operate with ACLs

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/316b9d771fe2692c. Report an issue: GitHub.