public static <T> T getObjectOfTypeFromClassName(String className, Class<T> expectedClazz) {
    Class actualClass;
    try {
      actualClass = classFromName(className);
    } catch (Exception e) {
      throw new GemFireSecurityException("Instance could not be obtained, " + e, e);
    }

    if (!expectedClazz.isAssignableFrom(actualClass)) {
      throw new GemFireSecurityException(
          "Instance could not be obtained. Expecting a " + expectedClazz.getName() + " class.");
    }

    try {
      return (T) actualClass.newInstance();
    } catch (Exception e) {
      throw new GemFireSecurityException(
          "Instance could not be obtained. Error instantiating " + actualClass.getName(), e);
    }
  }
this method would never return null, it either throws an exception or returns an object
geode-core/src/main/java/org/apache/geode/internal/security/CallbackInstantiator.java