{"record":{"id":"89ec9b8730e314cf","repo":"spring-projects/spring-security","slug":"org-springframework-security-config-annotation-met","errorCode":null,"errorMessage":"org.springframework.security.config.annotation.method.configuration.ObjectPostProcessor is a required bean. Ensure you have used @org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity","messagePattern":"org\\.springframework\\.security\\.config\\.annotation\\.method\\.configuration\\.ObjectPostProcessor is a required bean\\. Ensure you have used @org\\.springframework\\.security\\.config\\.annotation\\.method\\.configuration\\.EnableGlobalMethodSecurity","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java","lineNumber":104,"sourceCode":" * @author Ngoc Nhan\n * @since 3.2\n * @see EnableGlobalMethodSecurity\n * @deprecated Use {@link PrePostMethodSecurityConfiguration},\n * {@link SecuredMethodSecurityConfiguration}, or\n * {@link Jsr250MethodSecurityConfiguration} instead\n */\n@Deprecated\n@Configuration(proxyBeanMethods = false)\n@Role(BeanDefinition.ROLE_INFRASTRUCTURE)\npublic class GlobalMethodSecurityConfiguration implements ImportAware, SmartInitializingSingleton, BeanFactoryAware {\n\n\tprivate static final Log logger = LogFactory.getLog(GlobalMethodSecurityConfiguration.class);\n\n\tprivate ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<>() {\n\n\t\t@Override\n\t\tpublic <T> T postProcess(T object) {\n\t\t\tthrow new IllegalStateException(ObjectPostProcessor.class.getName()\n\t\t\t\t\t+ \" is a required bean. Ensure you have used @\" + EnableGlobalMethodSecurity.class.getName());\n\t\t}\n\n\t};\n\n\tprivate SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder\n\t\t.getContextHolderStrategy();\n\n\tprivate DefaultMethodSecurityExpressionHandler defaultMethodExpressionHandler = new DefaultMethodSecurityExpressionHandler();\n\n\tprivate AuthenticationManager authenticationManager;\n\n\tprivate AuthenticationManagerBuilder auth;\n\n\tprivate boolean disableAuthenticationRegistry;\n\n\tprivate AnnotationAttributes enableMethodSecurity;\n","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java#L86-L122","documentation":"GlobalMethodSecurityConfiguration requires an ObjectPostProcessor bean to post-process the security objects it builds. The default field value is a stub that always throws; it is only replaced when the Spring context supplies the real ObjectPostProcessor bean, which is registered by @EnableGlobalMethodSecurity. If the configuration class is instantiated without that annotation's import machinery, the stub throws this IllegalStateException.","triggerScenarios":"Subclassing or manually registering GlobalMethodSecurityConfiguration without @EnableGlobalMethodSecurity (or @EnableMethodSecurity) driving the import; instantiating the configuration in a test context missing the ObjectPostProcessor bean; using the class in a non-Spring Boot context without the security config infrastructure.","commonSituations":"Developers copy GlobalMethodSecurityConfiguration into their own @Configuration but forget @EnableGlobalMethodSecurity on any configuration; component-scanning the class directly; custom method-security setups in legacy XML/Java hybrid configs.","solutions":["Annotate one @Configuration class with @EnableGlobalMethodSecurity(prePostEnabled = true) (or @EnableMethodSecurity on Spring Security 5.6+) so the ObjectPostProcessor bean is registered","Remove any manual @Bean/@Import of GlobalMethodSecurityConfiguration and let EnableGlobalMethodSecurity import it","If building context manually in tests, include the Spring security configuration imports or inject an ObjectPostProcessor bean"],"exampleFix":"// before\n@Configuration\npublic class MySecurityConfig extends GlobalMethodSecurityConfiguration { ... }\n// after\n@Configuration\n@EnableGlobalMethodSecurity(prePostEnabled = true)\npublic class MySecurityConfig extends GlobalMethodSecurityConfiguration { ... }","handlingStrategy":"validation","validationCode":"if (!configClass.isAnnotationPresent(EnableGlobalMethodSecurity.class)\n        && !configClass.isAnnotationPresent(EnableMethodSecurity.class)) {\n    throw new IllegalStateException(\n        configClass.getName() + \" must be used with @EnableGlobalMethodSecurity or @EnableMethodSecurity\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    ctx.refresh();\n} catch (BeanCreationException e) {\n    if (e.getRootCause() instanceof IllegalStateException ise\n            && ise.getMessage().contains(\"ObjectPostProcessor is a required bean\")) {\n        throw new IllegalStateException(\"Add @EnableGlobalMethodSecurity to your configuration\", e);\n    }\n    throw e;\n}","preventionTips":["Always pair a GlobalMethodSecurityConfiguration subclass with @EnableGlobalMethodSecurity or @EnableMethodSecurity","Do not component-scan or manually register GlobalMethodSecurityConfiguration directly","In integration tests, use the full security configuration imports rather than instantiating the class alone"],"tags":["spring-security","spring","method-security","configuration"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}