wuyouzhuguli/SpringAll · error · InternalAuthenticationServiceException

未找到与该手机号对应的用户

Error message

未找到与该手机号对应的用户

What it means

Spring Security's InternalAuthenticationServiceException, thrown by SmsAuthenticationProvider.authenticate when userDetailService.loadUserByUsername returns null for the mobile number. InternalAuthenticationServiceException signals a server-side/internal problem rather than a user credential error. Note the Spring convention is for UserDetailsService to throw UsernameNotFoundException on a miss, not return null, so this branch typically indicates a non-conformant custom UserDetailService.

Source

Thrown at 38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationProvider.java:20

import cc.mrbird.security.browser.UserDetailService;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.InternalAuthenticationServiceException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UserDetails;

public class SmsAuthenticationProvider implements AuthenticationProvider {

    private UserDetailService userDetailService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        SmsAuthenticationToken authenticationToken = (SmsAuthenticationToken) authentication;
        UserDetails userDetails = userDetailService.loadUserByUsername((String) authenticationToken.getPrincipal());

        if (userDetails == null)
            throw new InternalAuthenticationServiceException("未找到与该手机号对应的用户");

        SmsAuthenticationToken authenticationResult = new SmsAuthenticationToken(userDetails, userDetails.getAuthorities());

        authenticationResult.setDetails(authenticationToken.getDetails());

        return authenticationResult;
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return SmsAuthenticationToken.class.isAssignableFrom(aClass);
    }

    public UserDetailService getUserDetailService() {
        return userDetailService;
    }

    public void setUserDetailService(UserDetailService userDetailService) {

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Make UserDetailService.loadUserByUsername throw UsernameNotFoundException (Spring convention) when the mobile is unknown, so it maps to the standard auth-failure flow.
  2. Register the user/mobile in the user store if login should succeed.
  3. Verify the correct UserDetailService bean is wired into SmsAuthenticationProvider.
  4. Confirm the mobile lookup query matches how numbers are stored (formatting, country code).

Example fix

// before
public UserDetails loadUserByUsername(String mobile) {
    User u = userMapper.findByMobile(mobile);
    return u;            // returns null -> InternalAuthenticationServiceException
}

// after
public UserDetails loadUserByUsername(String mobile) {
    User u = userMapper.findByMobile(mobile);
    if (u == null) {
        throw new UsernameNotFoundException("mobile not found: " + mobile);
    }
    return u;
}
Defensive patterns

Strategy: validation

Validate before calling

// before triggering SMS auth, confirm the mobile is registered
boolean exists = userMapper.existsByMobile(mobile);
if (!exists) {
    throw new UsernameNotFoundException("mobile not registered");
}

Try / catch

// In the provider, treat null as a not-found rather than an internal error
UserDetails userDetails = userDetailService.loadUserByUsername(mobile);
if (userDetails == null) {
    throw new UsernameNotFoundException("未找到与该手机号对应的用户");
}

Prevention

When it happens

Trigger: SMS login (POST /login/mobile) for a mobile number not present in the user store, when the configured UserDetailService returns null instead of throwing.

Common situations: Custom UserDetailService returns null on miss; the mobile number is not registered; userDetailService bean is the wrong implementation or not injected; DB query for the mobile returns no row.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/77099c1386f35c26. Report an issue: GitHub.