spring-projects/spring-security · error · IllegalArgumentException

Unsupported implementation of Sid

Error message

Unsupported implementation of Sid

What it means

JdbcMutableAclService.createOrRetrieveSidPrimaryKey maps a Sid to its acl_sid row and only understands two Sid implementations: PrincipalSid and GrantedAuthoritySid. Any other Sid subclass reaches the final statement and throws IllegalArgumentException("Unsupported implementation of Sid"). Sid is an interface, so custom implementations are not supported by the JDBC service.

Source

Thrown at acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java:243

	 * Retrieves the primary key from acl_sid, creating a new row if needed and the
	 * allowCreate property is true.
	 * @param sid to find or create
	 * @param allowCreate true if creation is permitted if not found
	 * @return the primary key or null if not found
	 * @throws IllegalArgumentException if the <tt>Sid</tt> is not a recognized
	 * implementation.
	 */
	protected @Nullable Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
		Assert.notNull(sid, "Sid required");
		if (sid instanceof PrincipalSid) {
			String sidName = ((PrincipalSid) sid).getPrincipal();
			return createOrRetrieveSidPrimaryKey(sidName, true, allowCreate);
		}
		if (sid instanceof GrantedAuthoritySid) {
			String sidName = ((GrantedAuthoritySid) sid).getGrantedAuthority();
			return createOrRetrieveSidPrimaryKey(sidName, false, allowCreate);
		}
		throw new IllegalArgumentException("Unsupported implementation of Sid");
	}

	/**
	 * Retrieves the primary key from acl_sid, creating a new row if needed and the
	 * allowCreate property is true.
	 * @param sidName name of Sid to find or to create
	 * @param sidIsPrincipal whether it's a user or granted authority like role
	 * @param allowCreate true if creation is permitted if not found
	 * @return the primary key or null if not found
	 */
	protected @Nullable Long createOrRetrieveSidPrimaryKey(String sidName, boolean sidIsPrincipal,
			boolean allowCreate) {
		List<@Nullable Long> sidIds = this.jdbcOperations.queryForList(this.selectSidPrimaryKey, Long.class,
				sidIsPrincipal, sidName);
		if (!sidIds.isEmpty()) {
			Long result = sidIds.get(0);
			if (result != null) {
				return result;

View on GitHub (pinned to 96852e8860)

Solutions

1. Convert custom sids to PrincipalSid (for users) or GrantedAuthoritySid (for roles) before passing them to ACL service methods.
2. Derive sids via SidRetrievalStrategy (e.g. SidRetrievalStrategyImpl) which returns only supported implementations.
3. If a custom Sid must be supported, subclass or patch the service (override createOrRetrieveSidPrimaryKey) — standard JdbcMutableAclService cannot handle it.
4. Log/inspect the runtime class of the Sid being passed to find where the unsupported implementation originates.

Example fix

// before
acl.insertAce(aceOrder, permission, new CustomSid(user), true);
// after
Sid sid = new PrincipalSid(user); // or new GrantedAuthoritySid(role)
acl.insertAce(aceOrder, permission, sid, true);
mutableAclService.updateAcl(acl);

if (!(sid instanceof PrincipalSid) && !(sid instanceof GrantedAuthoritySid)) {
    throw new IllegalArgumentException("Sid must be PrincipalSid or GrantedAuthoritySid");
}

boolean isSupportedSid(Sid s) {
    return s instanceof PrincipalSid || s instanceof GrantedAuthoritySid;
}

null

When it happens

Trigger: Passing a custom class implementing Sid (not PrincipalSid/GrantedAuthoritySid) to createAcl, updateAcl (owner or ACE sid), insertAce, or any path that resolves sid primary keys (sidPrimaryKey, sidId, ownerSid).

Common situations: Implementing the Sid interface for a custom principal type and using it as ACL owner or ACE recipient; wrapping sids in a decorator; a library version where a third-party Sid implementation is passed in; confusing Authentication objects with Sid objects.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• AclEntryAfterInvocationProvider.noPermission
• Authenticated principal required to operate with ACLs
• Principal does not have required ACL permissions to perform
• Unable to find ACL information for object identity '{oid}'
• Object identity '{objectIdentity}' already exists

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b95376f8c5a4e5d2. Report an issue: GitHub.