diff --git a/server-webapp/src/main/java/org/taverna/server/master/identity/WorkflowInternalAuthProvider.java b/server-webapp/src/main/java/org/taverna/server/master/identity/WorkflowInternalAuthProvider.java
index f6514d4..61f9d2e 100644
--- a/server-webapp/src/main/java/org/taverna/server/master/identity/WorkflowInternalAuthProvider.java
+++ b/server-webapp/src/main/java/org/taverna/server/master/identity/WorkflowInternalAuthProvider.java
@@ -179,9 +179,14 @@
 		if (logDecisions)
 			log.info("request for auth for user " + username);
 		String wfid = username.substring(PREFIX.length());
-		String securityToken = dao.getSecurityToken(wfid);
-		if (securityToken == null)
+		final String securityToken;
+		try {
+			securityToken = dao.getSecurityToken(wfid);
+			if (securityToken == null)
+				throw new UsernameNotFoundException("no such user");
+		} catch (NullPointerException npe) {
 			throw new UsernameNotFoundException("no such user");
+		}
 		return new User(username, securityToken, true, true, true, true,
 				Arrays.asList(new LiteralGrantedAuthority(SELF),
 						new WorkflowSelfAuthority(wfid)));
diff --git a/server-webapp/src/main/java/org/taverna/server/master/worker/RunDatabaseDAO.java b/server-webapp/src/main/java/org/taverna/server/master/worker/RunDatabaseDAO.java
index 357080f..4f98d33 100644
--- a/server-webapp/src/main/java/org/taverna/server/master/worker/RunDatabaseDAO.java
+++ b/server-webapp/src/main/java/org/taverna/server/master/worker/RunDatabaseDAO.java
@@ -83,6 +83,8 @@
 	@WithinSingleTransaction
 	public String getSecurityToken(String name) {
 		RunConnection rc = getById(name);
+		if (rc == null)
+			return null;
 		return rc.getSecurityToken();
 	}