{"record":{"id":"6e4b0c6b839b4541","repo":"spring-projects/spring-security","slug":"authorizationmanagerfactory-must-be-an-instance-of-6e4b0c","errorCode":null,"errorMessage":"authorizationManagerFactory must be an instance of DefaultAuthorizationManagerFactory","messagePattern":"authorizationManagerFactory must be an instance of DefaultAuthorizationManagerFactory","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/access/expression/SecurityExpressionRoot.java","lineNumber":288,"sourceCode":"\t */\n\tpublic void setAuthorizationManagerFactory(AuthorizationManagerFactory<T> authorizationManagerFactory) {\n\t\tAssert.notNull(authorizationManagerFactory, \"authorizationManagerFactory cannot be null\");\n\t\tthis.authorizationManagerFactory = authorizationManagerFactory;\n\t}\n\n\t/**\n\t * Allows accessing the {@link DefaultAuthorizationManagerFactory} for getting and\n\t * setting defaults. This method will be removed in Spring Security 8.\n\t * @return the {@link DefaultAuthorizationManagerFactory}\n\t * @throws IllegalStateException if a different {@link AuthorizationManagerFactory}\n\t * was already set\n\t * @deprecated Use\n\t * {@link #setAuthorizationManagerFactory(AuthorizationManagerFactory)} instead\n\t */\n\t@Deprecated(since = \"7.0\", forRemoval = true)\n\tprivate DefaultAuthorizationManagerFactory<T> getDefaultAuthorizationManagerFactory() {\n\t\tif (!(this.authorizationManagerFactory instanceof DefaultAuthorizationManagerFactory<T> defaultAuthorizationManagerFactory)) {\n\t\t\tthrow new IllegalStateException(\n\t\t\t\t\t\"authorizationManagerFactory must be an instance of DefaultAuthorizationManagerFactory\");\n\t\t}\n\n\t\treturn defaultAuthorizationManagerFactory;\n\t}\n\n\t@Override\n\tpublic boolean hasPermission(Object target, Object permission) {\n\t\treturn this.permissionEvaluator.hasPermission(getAuthentication(), target, permission);\n\t}\n\n\t@Override\n\tpublic boolean hasPermission(Object targetId, String targetType, Object permission) {\n\t\treturn this.permissionEvaluator.hasPermission(getAuthentication(), (Serializable) targetId, targetType,\n\t\t\t\tpermission);\n\t}\n\n\tpublic void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/access/expression/SecurityExpressionRoot.java#L270-L306","documentation":"SecurityExpressionRoot keeps an AuthorizationManagerFactory; deprecated setters (setTrustResolver, setRoleHierarchy, setDefaultRolePrefix) still work by mutating the field only if it is a DefaultAuthorizationManagerFactory. If a custom AuthorizationManagerFactory was installed via setAuthorizationManagerFactory, calling these legacy setters throws IllegalStateException because the legacy mutation cannot be applied.","triggerScenarios":"Calling setDefaultRolePrefix, setTrustResolver, or setRoleHierarchy on a SecurityExpressionRoot (or handler configured with one) after replacing the authorizationManagerFactory with a non-default AuthorizationManagerFactory implementation.","commonSituations":"Migrating from Spring Security 5.x/6.x role-prefix/hierarchy setters to the 7.0 AuthorizationManagerFactory API; mixing deprecated configuration with new custom factory beans.","solutions":["Stop using the deprecated setters; configure role hierarchy via the AuthorizationManagerFactory instead","Set the role hierarchy/prefix before any deprecated setter is called, or use DefaultAuthorizationManagerFactory explicitly","Replace setRoleHierarchy(...) with RoleHierarchyAuthorityMappingStrategy wiring on the authorization manager","Update custom code to use setAuthorizationManagerFactory(new DefaultAuthorizationManagerFactory<>()) configured with the desired prefix"],"exampleFix":"// before\nhandler.setRoleHierarchy(roleHierarchy);\nhandler.setAuthorizationManagerFactory(customFactory);\n// after\nDefaultAuthorizationManagerFactory<Object> factory = new DefaultAuthorizationManagerFactory<>();\nfactory.setRoleHierarchy(roleHierarchy);\nhandler.setAuthorizationManagerFactory(factory);","handlingStrategy":"validation","validationCode":"if (!(root.getAuthorizationManagerFactory() instanceof DefaultAuthorizationManagerFactory)) {\n  throw new IllegalStateException(\"Use setAuthorizationManagerFactory instead of deprecated setters\");\n}","typeGuard":"if (factory instanceof DefaultAuthorizationManagerFactory<?> d) { d.setDefaultRolePrefix(prefix); }","tryCatchPattern":"try { root.setDefaultRolePrefix(\"ROLE_\"); }\ncatch (IllegalStateException e) { configureViaFactory(); }","preventionTips":["Treat @Deprecated(since=\"7.0\") setters as removed in new code","Configure role hierarchy/prefix on DefaultAuthorizationManagerFactory only","Centralize security config in one class to avoid mixing legacy and new APIs","Check Spring Security 7.0 migration guide before upgrading"],"tags":["spring-security","deprecation","role-hierarchy","state"],"backgroundTag":"invalid-state-transition","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}