{"record":{"id":"8581935dc26ea622","repo":"spring-projects/spring-security","slug":"failed-to-resolve-an-unique-bean-single-or-primar","errorCode":null,"errorMessage":"Failed to resolve an unique bean (single or primary) of type [{object.getClass()}] from the BeanFactory.\nBecause the object is a CGLIB Proxy, a raw bean cannot be initialized during runtime in a native image.\n","messagePattern":"Failed to resolve an unique bean \\(single or primary\\) of type \\[(.+?)\\] from the BeanFactory\\.\nBecause the object is a CGLIB Proxy, a raw bean cannot be initialized during runtime in a native image\\.\n","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/configuration/AutowireBeanFactoryObjectPostProcessor.java","lineNumber":108,"sourceCode":"\t * the application is a native image\n\t * @see <a href=\n\t * \"https://github.com/spring-projects/spring-security/issues/14825\">Issue\n\t * gh-14825</a>\n\t */\n\t@SuppressWarnings(\"unchecked\")\n\tprivate <T> T initializeBeanIfNeeded(T object) {\n\t\tif (!NativeDetector.inNativeImage() || !AopUtils.isCglibProxy(object)) {\n\t\t\treturn (T) this.autowireBeanFactory.initializeBean(object, object.toString());\n\t\t}\n\t\tObjectProvider<?> provider = this.autowireBeanFactory.getBeanProvider(object.getClass());\n\t\tObject bean = provider.getIfUnique();\n\t\tif (bean == null) {\n\t\t\tString msg = \"\"\"\n\t\t\t\t\tFailed to resolve an unique bean (single or primary) of type [%s] from the BeanFactory.\n\t\t\t\t\tBecause the object is a CGLIB Proxy, a raw bean cannot be initialized during runtime in a native image.\n\t\t\t\t\t\"\"\"\n\t\t\t\t.formatted(object.getClass());\n\t\t\tthrow new IllegalStateException(msg);\n\t\t}\n\t\treturn (T) bean;\n\t}\n\n\t@Override\n\tpublic void afterSingletonsInstantiated() {\n\t\tfor (SmartInitializingSingleton singleton : this.smartSingletons) {\n\t\t\tsingleton.afterSingletonsInstantiated();\n\t\t}\n\t}\n\n\t@Override\n\tpublic void destroy() {\n\t\tfor (DisposableBean disposable : this.disposableBeans) {\n\t\t\ttry {\n\t\t\t\tdisposable.destroy();\n\t\t\t}\n\t\t\tcatch (Exception ex) {","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/configuration/AutowireBeanFactoryObjectPostProcessor.java#L90-L126","documentation":"In a GraalVM native image, initializeBeanIfNeeded cannot resolve/initialize a raw bean for a CGLIB proxy object; when the BeanFactory lookup returns null it throws IllegalStateException with a message naming the unresolved type. Native images forbid creating/initializing raw beans at runtime for proxied types because the necessary reflective metadata is absent.","triggerScenarios":"Running a Spring Security configuration in a native image where an object passed to postProcess is a CGLIB proxy (e.g. @Configuration- or @Transactional-proxied classes) and initializeBeanIfNeeded does a getBean of that type which fails to find a unique single/primary bean.","commonSituations":"Spring Boot native (AOT) builds with security configurers post-processing proxied beans; multiple beans of the same type so no unique candidate resolves; missing native hints for custom configurer classes.","solutions":["Avoid passing CGLIB-proxied objects through ObjectPostProcessor in native images; post-process the underlying instance or disable proxying where possible.","Register native/AOT hints (RuntimeHints) for the affected classes so bean resolution works in the image.","Ensure exactly one primary/single bean of the required type exists, or qualify the bean explicitly.","Prefer JDK dynamic proxies (proxyTargetClass=false) or restructure config so the object is not proxied before initialization."],"exampleFix":"// before\nhttp.objectPostProcessor.postProcess(proxiedConfigurer); // fails in native image\n// after\nhttp.objectPostProcessor.postProcess(new MyConfigurer()); // raw instance, no CGLIB proxy","handlingStrategy":"try-catch","validationCode":"// before post-processing in native image\nif (SpringFactoriesUtils // or AOT check\n        .isNativeImage() && AopUtils.isCglibProxy(object)) {\n    throw new IllegalStateException(\"Cannot postProcess CGLIB proxy \" + object.getClass() + \" in native image\");\n}","typeGuard":"static boolean isCglibProxy(Object o) {\n    return o != null && org.springframework.aop.support.AopUtils.isCglibProxy(o);\n}","tryCatchPattern":"try {\n    processed = objectPostProcessor.postProcess(object);\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"CGLIB Proxy\")) {\n        // rebuild with the raw (unproxied) instance or register native hints\n        processed = objectPostProcessor.postProcess(AopProxyUtils.getSingletonTarget(object));\n    } else {\n        throw e;\n    }\n}","preventionTips":["Do not pass @Configuration/@Transactional-proxied objects into security post-processors in native builds","Register RuntimeHints for custom configurer classes","Ensure a unique primary bean exists for post-processed types","Test with native-image (AOT) builds in CI, not just JVM runs"],"tags":["native-image","graalvm","cglib","spring-aot"],"backgroundTag":"unsupported-platform","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}