spring-projects/spring-security · error · LoginException

Login cannot complete, authentication not found in security

Error message

Login cannot complete, authentication not found in security context

What it means

SecurityContextLoginModule.login() throws LoginException when no Authentication is found in the SecurityContext, i.e. login() is invoked before Spring Security has authenticated the user. JAAS LoginModule semantics require the module to find a pre-populated Authentication to 'share' into the JAAS Subject. If ignoreMissingAuthentication is true it logs a warning and returns false instead of throwing.

Source

Thrown at core/src/main/java/org/springframework/security/authentication/jaas/SecurityContextLoginModule.java:154

		}
	}

	/**
	 * Authenticate the <code>Subject</code> (phase one) by extracting the Spring Security
	 * <code>Authentication</code> from the current <code>SecurityContext</code>.
	 * @return true if the authentication succeeded, or false if this
	 * <code>LoginModule</code> should be ignored.
	 * @throws LoginException if the authentication fails
	 */
	@Override
	public boolean login() throws LoginException {
		this.authen = this.securityContextHolderStrategy.getContext().getAuthentication();
		if (this.authen != null) {
			return true;
		}
		String msg = "Login cannot complete, authentication not found in security context";
		if (!this.ignoreMissingAuthentication) {
			throw new LoginException(msg);
		}
		log.warn(msg);
		return false;
	}

	/**
	 * Log out the <code>Subject</code>.
	 * @return true if this method succeeded, or false if this <code>LoginModule</code>
	 * should be ignored.
	 */
	@Override
	public boolean logout() {
		if (this.authen == null) {
			return false;
		}
		Assert.notNull(this.subject, "subject cannot be null");
		this.subject.getPrincipals().remove(this.authen);
		this.authen = null;

View on GitHub (pinned to 96852e8860)

Solutions

Ensure the request passes through the Spring Security filter chain so the SecurityContext is populated before the JAAS LoginModule runs
Set ignoreMissingAuthentication=true in the JAAS configuration if an absent Authentication should be tolerated rather than fatal
Populate the SecurityContext manually (SecurityContextHolder.getContext().setAuthentication(...)) before invoking the LoginModule in tests or programmatic flows
Verify the shared state / securityContextHolderStrategy sees the same thread; do not call login() from a different thread than the one holding the context

Example fix

// before (jaas.conf)
Example { org.springframework.security.authentication.jaas.SecurityContextLoginModule required; };
// after
tolerant { org.springframework.security.authentication.jaas.SecurityContextLoginModule required ignoreMissingAuthentication=true; };

Defensive patterns

Strategy: type-guard

Validate before calling

if (SecurityContextHolder.getContext().getAuthentication() == null || !SecurityContextHolder.getContext().getAuthentication().isAuthenticated()) { throw new IllegalStateException("run after Spring Security filter chain has authenticated the request"); }

Type guard

boolean hasAuthentication() { Authentication a = SecurityContextHolder.getContext().getAuthentication(); return a != null && a.isAuthenticated() && !(a instanceof AnonymousAuthenticationToken); }

Try / catch

try { return loginContext.login(); } catch (LoginException e) { log.warn("No SecurityContext authentication for JAAS login", e); return false; }

Prevention

Register the JAAS callback only inside requests processed by the Spring Security filter chain
Set ignoreMissingAuthentication=true when absence of authentication is an expected, tolerated case
Never call the LoginModule from a thread without a populated SecurityContextHolder

When it happens

Trigger: Configuring SecurityContextLoginModule in a JAAS login configuration for a request that has not been authenticated by Spring Security (anonymous or unauthenticated session); calling login() outside a Spring Security filter chain so the SecurityContextHolder is empty; the JAAS authentication loop running before the SecurityContextPersistenceFilter/SecurityContextHolderFilter populated the context.

Common situations: Bridging legacy JAAS-based systems (e.g. JBoss, WebSphere SSO) with Spring Security where the filter chain is not registered or ordered before the JAAS callback; programmatic Subject.doAs() usage without first setting a SecurityContext in tests.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/37dc7846396c6f50. Report an issue: GitHub.