{"record":{"id":"262abd07d59b1ee2","repo":"spring-projects/spring-security","slug":"global-authenticationmanager-configured-with-an-au","errorCode":null,"errorMessage":"Global AuthenticationManager configured with an AuthenticationProvider bean. UserDetailsService beans will not be used by Spring Security for automatically configuring username/password login. Consider removing the AuthenticationProvider bean. Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider. If the current configuration is intentional, to turn off this warning, increase the logging level of 'org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer' to ERROR","messagePattern":"Global AuthenticationManager configured with an AuthenticationProvider bean\\. UserDetailsService beans will not be used by Spring Security for automatically configuring username/password login\\. Consider removing the AuthenticationProvider bean\\. Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider\\. If the current configuration is intentional, to turn off this warning, increase the logging level of 'org\\.springframework\\.security\\.config\\.annotation\\.authentication\\.configuration\\.InitializeUserDetailsBeanManagerConfigurer' to ERROR","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java","lineNumber":74,"sourceCode":"\t\tthis.context = context;\n\t}\n\n\t@Override\n\tpublic void init(AuthenticationManagerBuilder auth) {\n\t\tauth.apply(new InitializeUserDetailsManagerConfigurer());\n\t}\n\n\tclass InitializeUserDetailsManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {\n\n\t\tprivate final Log logger = LogFactory.getLog(getClass());\n\n\t\t@Override\n\t\tpublic void configure(AuthenticationManagerBuilder auth) {\n\t\t\tString[] beanNames = InitializeUserDetailsBeanManagerConfigurer.this.context\n\t\t\t\t.getBeanNamesForType(UserDetailsService.class);\n\t\t\tif (auth.isConfigured()) {\n\t\t\t\tif (beanNames.length > 0) {\n\t\t\t\t\tthis.logger.warn(\"Global AuthenticationManager configured with an AuthenticationProvider bean. \"\n\t\t\t\t\t\t\t+ \"UserDetailsService beans will not be used by Spring Security for automatically configuring username/password login. \"\n\t\t\t\t\t\t\t+ \"Consider removing the AuthenticationProvider bean. \"\n\t\t\t\t\t\t\t+ \"Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider. \"\n\t\t\t\t\t\t\t+ \"If the current configuration is intentional, to turn off this warning, \"\n\t\t\t\t\t\t\t+ \"increase the logging level of 'org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer' to ERROR\");\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (beanNames.length == 0) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\telse if (beanNames.length > 1) {\n\t\t\t\tthis.logger.warn(LogMessage.format(\"Found %s UserDetailsService beans, with names %s. \"\n\t\t\t\t\t\t+ \"Global Authentication Manager will not use a UserDetailsService for username/password login. \"\n\t\t\t\t\t\t+ \"Consider publishing a single UserDetailsService bean.\", beanNames.length,\n\t\t\t\t\t\tArrays.toString(beanNames)));\n\t\t\t\treturn;","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java#L56-L92","documentation":"InitializeUserDetailsBeanManagerConfigurer auto-configures a global AuthenticationManager from a UserDetailsService bean, but only when no AuthenticationProvider has already been configured. When the AuthenticationManagerBuilder is already configured AND UserDetailsService beans exist, the UserDetailsService is silently unused and this warning is logged. It flags that username/password auto-configuration will not happen.","triggerScenarios":"Exposing both an AuthenticationProvider bean (or calling auth.authenticationProvider(...) in a global AuthenticationManagerBuilder) and one or more UserDetailsService beans in the same ApplicationContext, so InitializeUserDetailsBeanManagerConfigurer.configure() finds auth.isConfigured()==true and beanNames.length>0.","commonSituations":"Migrating from in-memory/user-details style config to a custom AuthenticationProvider while leaving a @Bean UserDetailsService behind; adding a custom provider to a Spring Boot app that already publishes a UserDetailsService; combining XML and annotation-based security config.","solutions":["Remove the standalone UserDetailsService bean and rely solely on the explicit AuthenticationProvider bean.","If you need the UserDetailsService, wire it into a manually instantiated DaoAuthenticationProvider and register that provider instead.","If the setup is intentional, raise the log level of org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer to ERROR to suppress the warning."],"exampleFix":"// before\n@Bean\nUserDetailsService userDetailsService() { return new MyUserDetailsService(); }\n@Bean\nAuthenticationProvider authProvider() { return new MyAuthenticationProvider(); }\n\n// after\n@Bean\nAuthenticationProvider authProvider() {\n    DaoAuthenticationProvider p = new DaoAuthenticationProvider();\n    p.setUserDetailsService(new MyUserDetailsService());\n    return p;\n}","handlingStrategy":"validation","validationCode":"String[] udsBeans = ctx.getBeanNamesForType(UserDetailsService.class);\nboolean providerConfigured = auth.isConfigured();\nif (providerConfigured && udsBeans.length > 0) {\n    throw new IllegalStateException(\"Remove the UserDetailsService bean or wire it into a DaoAuthenticationProvider\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pick one authentication source per application: either provider beans or a single UserDetailsService.","Wire UserDetailsService into DaoAuthenticationProvider when both concepts are needed.","Search the context for stray UserDetailsService beans before release."],"tags":["spring-security","authentication","auto-configuration","logging"],"backgroundTag":"conflicting-config-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}