{"record":{"id":"3a8a3cc6b343df10","repo":"spring-projects/spring-security","slug":"did-you-forget-to-add-a-global-authentication-man","errorCode":null,"errorMessage":"Did you forget to add a global <authentication-manager> element to your configuration (with child <authentication-provider> elements)? Alternatively you can use the authentication-manager-ref attribute on your <http> and <global-method-security> elements.","messagePattern":"Did you forget to add a global <authentication-manager> element to your configuration \\(with child <authentication-provider> elements\\)\\? Alternatively you can use the authentication-manager-ref attribute on your <http> and <global-method-security> elements\\.","errorType":"exception","errorClass":"NoSuchBeanDefinitionException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/authentication/AuthenticationManagerFactoryBean.java","lineNumber":66,"sourceCode":"\n\tprivate ObservationRegistry observationRegistry = ObservationRegistry.NOOP;\n\n\tpublic static final String MISSING_BEAN_ERROR_MESSAGE = \"Did you forget to add a global <authentication-manager> element \"\n\t\t\t+ \"to your configuration (with child <authentication-provider> elements)? Alternatively you can use the \"\n\t\t\t+ \"authentication-manager-ref attribute on your <http> and <global-method-security> elements.\";\n\n\t@Override\n\tpublic AuthenticationManager getObject() throws Exception {\n\t\ttry {\n\t\t\treturn (AuthenticationManager) this.bf.getBean(BeanIds.AUTHENTICATION_MANAGER);\n\t\t}\n\t\tcatch (NoSuchBeanDefinitionException ex) {\n\t\t\tif (!BeanIds.AUTHENTICATION_MANAGER.equals(ex.getBeanName())) {\n\t\t\t\tthrow ex;\n\t\t\t}\n\t\t\tUserDetailsService uds = this.bf.getBeanProvider(UserDetailsService.class).getIfUnique();\n\t\t\tif (uds == null) {\n\t\t\t\tthrow new NoSuchBeanDefinitionException(BeanIds.AUTHENTICATION_MANAGER, MISSING_BEAN_ERROR_MESSAGE);\n\t\t\t}\n\t\t\tDaoAuthenticationProvider provider = new DaoAuthenticationProvider(uds);\n\t\t\tPasswordEncoder passwordEncoder = this.bf.getBeanProvider(PasswordEncoder.class).getIfUnique();\n\t\t\tif (passwordEncoder != null) {\n\t\t\t\tprovider.setPasswordEncoder(passwordEncoder);\n\t\t\t}\n\t\t\tprovider.afterPropertiesSet();\n\t\t\tProviderManager manager = new ProviderManager(Arrays.asList(provider));\n\t\t\tif (this.observationRegistry.isNoop()) {\n\t\t\t\treturn manager;\n\t\t\t}\n\t\t\treturn new ObservationAuthenticationManager(this.observationRegistry, manager);\n\t\t}\n\t}\n\n\t@Override\n\tpublic Class<? extends AuthenticationManager> getObjectType() {\n\t\treturn ProviderManager.class;","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/authentication/AuthenticationManagerFactoryBean.java#L48-L84","documentation":"AuthenticationManagerFactoryBean.getObject resolves the internal AuthenticationManager bean named 'authenticationManager'. If that bean is missing and no unique UserDetailsService bean exists to build a default DaoAuthenticationProvider, it throws NoSuchBeanDefinitionException carrying the long hint about adding a global <authentication-manager> element or using authentication-manager-ref. This is Spring Security XML namespace configuration failing to produce any authentication source.","triggerScenarios":"XML config has <http> or <global-method-security> that needs an AuthenticationManager, but there is no <authentication-manager> element and no exactly-one UserDetailsService bean in the context (zero or multiple candidates), so getObject cannot build a DaoAuthenticationProvider fallback.","commonSituations":"Migrating old XML security configs where the <authentication-manager> block was deleted; defining several UserDetailsService beans (e.g. two @Bean user detail services) so getIfUnique() returns null; using <http> without any authentication source at all.","solutions":["Add a global <authentication-manager> element with at least one <authentication-provider> child to the XML configuration.","Alternatively, set authentication-manager-ref on <http> (and <global-method-security>) to point at an explicitly defined AuthenticationManager bean.","If relying on the UserDetailsService fallback, ensure exactly one UserDetailsService bean exists in the context (remove or qualify duplicates with @Primary).","Optionally register a PasswordEncoder bean so the auto-built DaoAuthenticationProvider decodes passwords correctly."],"exampleFix":"<!-- before: no authentication source defined -->\n<http auto-config=\"true\"/>\n<!-- after -->\n<http auto-config=\"true\"/>\n<authentication-manager>\n  <authentication-provider>\n    <user-service>\n      <user name=\"user\" password=\"{noop}password\" authorities=\"ROLE_USER\"/>\n    </user-service>\n  </authentication-provider>\n</authentication-manager>","handlingStrategy":"validation","validationCode":"// Verify exactly one UserDetailsService and an AuthenticationManager are reachable\nlong udsCount = context.getBeanProvider(UserDetailsService.class).stream().count();\nboolean authManagerDefined = context.containsBean(\"authenticationManager\")\n    || context.getBeanNamesForType(AuthenticationManager.class).length > 0;\nif (udsCount != 1 && !authManagerDefined) {\n    throw new IllegalStateException(\n        \"Define a global <authentication-manager> or provide exactly one UserDetailsService bean\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    AuthenticationManager am = context.getBean(\"org.springframework.security.authenticationManager\",\n        AuthenticationManager.class);\n} catch (NoSuchBeanDefinitionException e) {\n    if (\"org.springframework.security.authenticationManager\".equals(e.getBeanName())) {\n        throw new IllegalStateException(\"Missing <authentication-manager>; add one with an <authentication-provider>\", e);\n    }\n    throw e;\n}","preventionTips":["Always pair <http> with a global <authentication-manager> in XML configs.","Keep only one UserDetailsService bean, or mark one @Primary.","Set authentication-manager-ref explicitly when using custom AuthenticationManagers.","Boot the context in a CI test to catch missing authentication sources early."],"tags":["spring-security","xml-config","authentication-manager","bean-not-found"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}