diff --git a/core/src/main/java/hudson/model/User.java b/core/src/main/java/hudson/model/User.java
index 4db6fea6188072dfc96172474e8d328a411cd91a..9dfe633f04ec41b1f00df44bcf631cd9a0d6d9f7 100644
--- a/core/src/main/java/hudson/model/User.java
+++ b/core/src/main/java/hudson/model/User.java
@@ -1054,7 +1054,12 @@ public class User extends AbstractModelObject implements AccessControlled, Descr
                     if (!resolving.get()) {
                         resolving.set(true);
                         try {
-                            return j.getSecurityRealm().loadUserByUsername(idOrFullName).getUsername();
+                            UserDetails userDetails = j.getSecurityRealm().loadUserByUsername(idOrFullName);
+                            if (userDetails == null) {
+                                throw new NullPointerException("hudson.security.SecurityRealm should never return null. "
+                                        + j.getSecurityRealm() + " returned null for idOrFullName='" + idOrFullName + "'");
+                            }
+                            return userDetails.getUsername();
                         } catch (UsernameNotFoundException x) {
                             LOGGER.log(Level.FINE, "not sure whether " + idOrFullName + " is a valid username or not", x);
                         } catch (DataAccessException x) {