{"record":{"id":"640afe4cf99acb1a","repo":"spring-projects/spring-security","slug":"managerpassword-is-required-if-managerdn-is-suppli","errorCode":null,"errorMessage":"managerPassword is required if managerDn is supplied","messagePattern":"managerPassword is required if managerDn is supplied","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java","lineNumber":567,"sourceCode":"\t\t/**\n\t\t * Gets the {@link LdapAuthenticationProviderConfigurer} for further\n\t\t * customizations.\n\t\t * @return the {@link LdapAuthenticationProviderConfigurer} for further\n\t\t * customizations\n\t\t */\n\t\tpublic LdapAuthenticationProviderConfigurer<B> and() {\n\t\t\treturn LdapAuthenticationProviderConfigurer.this;\n\t\t}\n\n\t\tprivate DefaultSpringSecurityContextSource build() {\n\t\t\tif (this.url == null) {\n\t\t\t\tstartEmbeddedLdapServer();\n\t\t\t}\n\t\t\tDefaultSpringSecurityContextSource contextSource = new DefaultSpringSecurityContextSource(getProviderUrl());\n\t\t\tif (this.managerDn != null) {\n\t\t\t\tcontextSource.setUserDn(this.managerDn);\n\t\t\t\tif (this.managerPassword == null) {\n\t\t\t\t\tthrow new IllegalStateException(\"managerPassword is required if managerDn is supplied\");\n\t\t\t\t}\n\t\t\t\tcontextSource.setPassword(this.managerPassword);\n\t\t\t}\n\t\t\tcontextSource = postProcess(contextSource);\n\t\t\treturn contextSource;\n\t\t}\n\n\t\tprivate void startEmbeddedLdapServer() {\n\t\t\tif (unboundIdPresent) {\n\t\t\t\tUnboundIdContainer unboundIdContainer = new UnboundIdContainer(this.root, this.ldif);\n\t\t\t\tunboundIdContainer.setPort(getPort());\n\t\t\t\tpostProcess(unboundIdContainer);\n\t\t\t\tthis.port = unboundIdContainer.getPort();\n\t\t\t}\n\t\t\telse {\n\t\t\t\tthrow new IllegalStateException(\"Embedded LDAP server is not provided\");\n\t\t\t}\n\t\t}","sourceCodeStart":549,"sourceCodeEnd":585,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java#L549-L585","documentation":"LdapAuthenticationProviderConfigurer.build() creates a DefaultSpringSecurityContextSource and, if a managerDn (bind user DN) was configured, requires a matching managerPassword; otherwise it throws IllegalStateException. The manager credentials are mandatory because the context source must bind to the LDAP server for searches.","triggerScenarios":"Configuring .managerDn(\"cn=admin,dc=example,dc=com\") via .managerDn() (or managerDn property) without calling .managerPassword(...), then completing the LDAP configuration (build/startup).","commonSituations":"Copy-pasted LDAP config where the password was left as a placeholder or loaded from an env var that resolves to null; YAML/properties wiring where managerPassword key is misspelled; switching from anonymous-bind config to a manager DN without adding the password.","solutions":["Call .managerPassword(\"...\") alongside .managerDn(\"...\") in the LdapAuthenticationProviderConfigurer.","Provide the password from configuration/environment, e.g. .managerPassword(env.getProperty(\"LDAP_PASSWORD\")), ensuring the property exists.","If anonymous binding is acceptable, remove the managerDn entirely so no password is required.","Double-check property key spelling/binding in application.yml so managerPassword is actually populated."],"exampleFix":"// before\nauth.ldapAuthentication().userDnPatterns(\"uid={0},ou=people\").managerDn(\"cn=admin,dc=example,dc=com\");\n// after\nauth.ldapAuthentication().userDnPatterns(\"uid={0},ou=people\")\n    .managerDn(\"cn=admin,dc=example,dc=com\")\n    .managerPassword(env.getProperty(\"LDAP_MANAGER_PASSWORD\"));","handlingStrategy":"validation","validationCode":"// before building the configurer\nif (managerDn != null && (managerPassword == null || managerPassword.isBlank())) {\n    throw new IllegalArgumentException(\"managerPassword must accompany managerDn\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return auth.ldapAuthentication()...build();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"managerPassword\")) {\n        throw new ConfigurationException(\"Set LDAP managerDn AND managerPassword (e.g. via env var)\", e);\n    }\n    throw e;\n}","preventionTips":["Always configure managerDn and managerPassword as a pair","Source LDAP credentials from environment/secret manager and verify presence at startup","If anonymous bind suffices, omit managerDn entirely","Add a startup smoke test that binds with the configured manager credentials"],"tags":["ldap","configuration","missing-credentials","spring-security"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}