{"record":{"id":"8da39912029978bb","repo":"spring-projects/spring-security","slug":"you-must-supply-user-definitions-either-with-use","errorCode":null,"errorMessage":"You must supply user definitions, either with <user> child elements or a properties file (using the 'properties' attribute)","messagePattern":"You must supply user definitions, either with <user> child elements or a properties file \\(using the 'properties' attribute\\)","errorType":"exception","errorClass":"BeanDefinitionStoreException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java","lineNumber":78,"sourceCode":"\t}\n\n\t@Override\n\t@SuppressWarnings(\"unchecked\")\n\tprotected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {\n\t\tString userProperties = element.getAttribute(ATT_PROPERTIES);\n\t\tList<Element> userElts = DomUtils.getChildElementsByTagName(element, ELT_USER);\n\t\tif (StringUtils.hasText(userProperties)) {\n\t\t\tif (!CollectionUtils.isEmpty(userElts)) {\n\t\t\t\tthrow new BeanDefinitionStoreException(\n\t\t\t\t\t\t\"Use of a properties file and user elements are mutually exclusive\");\n\t\t\t}\n\t\t\tBeanDefinition bd = new RootBeanDefinition(PropertiesFactoryBean.class);\n\t\t\tbd.getPropertyValues().addPropertyValue(\"location\", userProperties);\n\t\t\tbuilder.addConstructorArgValue(bd);\n\t\t\treturn;\n\t\t}\n\t\tif (CollectionUtils.isEmpty(userElts)) {\n\t\t\tthrow new BeanDefinitionStoreException(\"You must supply user definitions, either with <\" + ELT_USER\n\t\t\t\t\t+ \"> child elements or a \" + \"properties file (using the '\" + ATT_PROPERTIES + \"' attribute)\");\n\t\t}\n\t\tManagedList<BeanDefinition> users = new ManagedList<>();\n\t\tfor (Object elt : userElts) {\n\t\t\tElement userElt = (Element) elt;\n\t\t\tString userName = userElt.getAttribute(ATT_NAME);\n\t\t\tString password = userElt.getAttribute(ATT_PASSWORD);\n\t\t\tif (!StringUtils.hasLength(password)) {\n\t\t\t\tpassword = generateRandomPassword();\n\t\t\t}\n\t\t\tboolean locked = \"true\".equals(userElt.getAttribute(ATT_LOCKED));\n\t\t\tboolean disabled = \"true\".equals(userElt.getAttribute(ATT_DISABLED));\n\t\t\tBeanDefinitionBuilder authorities = BeanDefinitionBuilder.rootBeanDefinition(AuthorityUtils.class);\n\t\t\tauthorities.addConstructorArgValue(userElt.getAttribute(ATT_AUTHORITIES));\n\t\t\tauthorities.setFactoryMethod(\"commaSeparatedStringToAuthorityList\");\n\t\t\tBeanDefinitionBuilder user = BeanDefinitionBuilder.rootBeanDefinition(User.class);\n\t\t\tuser.addConstructorArgValue(userName);\n\t\t\tuser.addConstructorArgValue(password);","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java#L60-L96","documentation":"UserServiceBeanDefinitionParser requires at least one source of user definitions. If the <security:user-service> element has neither the 'properties' attribute nor any <user> child elements, there is nothing to build the InMemoryUserDetailsManager from, and doParse throws this BeanDefinitionStoreException during XML parsing.","triggerScenarios":"A <security:user-service> element (or <security:authentication-provider user-service-ref-less> inline form) appears in the XML with an empty body and no 'properties' attribute; CollectionUtils.isEmpty(userElts) is true and userProperties is blank.","commonSituations":"Stripping out <user> entries when moving users to a database but leaving the empty element behind; a templating/placeholder transformation removing the attribute value leaving ''; copy-pasting a minimal config snippet without filling in users.","solutions":["Add at least one <security:user name=... password=... authorities=.../> child element to <user-service>","Or set the properties attribute, e.g. properties=\"classpath:users.properties\"","If users are stored elsewhere (DB/LDAP), remove the in-memory user-service and configure a JdbcDaoImpl/LdapAuthenticationProvider instead"],"exampleFix":"// before\n<security:user-service/>\n// after\n<security:user-service>\n    <security:user name=\"user\" password=\"{noop}password\" authorities=\"ROLE_USER\"/>\n</security:user-service>","handlingStrategy":"validation","validationCode":"boolean hasProps = elt.hasAttribute(\"properties\") && !elt.getAttribute(\"properties\").isBlank();\nboolean hasUsers = elt.getElementsByTagNameNS(\"http://www.springframework.org/schema/security\", \"user\").getLength() > 0;\nif (!hasProps && !hasUsers) throw new IllegalArgumentException(\"user-service needs <user> children or a properties attribute\");","typeGuard":null,"tryCatchPattern":"try {\n    ctx = new ClassPathXmlApplicationContext(\"security.xml\");\n} catch (BeanDefinitionStoreException e) {\n    logger.error(\"Empty <user-service>: {}\", e.getMessage());\n}","preventionTips":["Never commit an empty <user-service/> element","When migrating users out of XML, remove the whole element rather than emptying it","Validate security XML with the Spring Security XSD during builds"],"tags":["spring-security","xml-config","bean-definition","missing-config"],"backgroundTag":"missing-required-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}