spring-projects/spring-security · error · IllegalStateException

kerberosClient must be set

Error message

kerberosClient must be set

What it means

KerberosAuthenticationProvider.authenticate requires a KerberosClient to perform the JAAS login. The provider throws IllegalStateException when `kerberosClient` was never injected, meaning the provider was not fully configured before use.

Source

Thrown at kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosAuthenticationProvider.java:45

/**
 * {@link AuthenticationProvider} for kerberos.
 *
 * @author Mike Wiesner
 * @author Bogdan Mustiata
 * @since 1.0
 */
public class KerberosAuthenticationProvider implements AuthenticationProvider {

	private @Nullable KerberosClient kerberosClient;

	private @Nullable UserDetailsService userDetailsService;

	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
		if (this.kerberosClient == null) {
			throw new IllegalStateException("kerberosClient must be set");
		}
		if (this.userDetailsService == null) {
			throw new IllegalStateException("userDetailsService must be set");
		}
		Object credentials = auth.getCredentials();
		if (credentials == null) {
			throw new IllegalArgumentException("credentials cannot be null");
		}
		JaasSubjectHolder subjectHolder = this.kerberosClient.login(auth.getName(), credentials.toString());
		String username = subjectHolder.getUsername();
		if (username == null) {
			throw new IllegalStateException("username cannot be null");
		}
		UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
		KerberosUsernamePasswordAuthenticationToken output = new KerberosUsernamePasswordAuthenticationToken(
				userDetails, credentials, userDetails.getAuthorities(), subjectHolder);
		output.setDetails(authentication.getDetails());
		return output;

View on GitHub (pinned to 96852e8860)

Solutions

1. Call setKerberosClient(...) with a configured KerberosClient (e.g. SunJaasKerberosClient) before the provider processes any authentication.
2. Ensure the KerberosClient bean exists and is injected into the provider.
3. Verify active Spring profiles actually register the client bean.

Example fix

// before
KerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();
provider.setUserDetailsService(myUds);
// after
SunJaasKerberosClient client = new SunJaasKerberosClient();
client.setDebug(true);
KerberosAuthenticationProvider provider = new KerberosAuthenticationProvider();
provider.setKerberosClient(client);
provider.setUserDetailsService(myUds);

if (provider instanceof KerberosAuthenticationProvider k && k.getKerberosClient() == null) throw new IllegalStateException("kerberosClient not wired");

try {
  return authenticationManager.authenticate(auth);
} catch (IllegalStateException e) {
  LOG.error("KerberosAuthenticationProvider misconfigured: {}", e.getMessage());
  throw e;
}

When it happens

Trigger: Adding a KerberosAuthenticationProvider to the AuthenticationManager (e.g. via WebSecurityConfigurerAdapter) without calling setKerberosClient, then attempting a username/password authentication.

Common situations: Copy-pasting a security config where the KerberosClient bean wiring was dropped or the bean is defined in a profile that isn't active, so the field stays null.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• userDetailsService must be set
• ticketValidator must be set
• userDetailsService must be set
• Kerberos authentication failed
• server_error

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/4f2ea5200e35dffa. Report an issue: GitHub.