{"record":{"id":"8e8769aefec7c8bc","repo":"spring-projects/spring-security","slug":"managerpassword-is-required-if-managerdn-is-suppli-8e8769","errorCode":null,"errorMessage":"managerPassword is required if managerDn is supplied","messagePattern":"managerPassword is required if managerDn is supplied","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/ldap/EmbeddedLdapServerContextSourceFactoryBean.java","lineNumber":140,"sourceCode":"\t * @param managerPassword password for the manager DN\n\t */\n\tpublic void setManagerPassword(String managerPassword) {\n\t\tthis.managerPassword = managerPassword;\n\t}\n\n\t@Override\n\tpublic DefaultSpringSecurityContextSource getObject() throws Exception {\n\t\tif (!unboundIdPresent) {\n\t\t\tthrow new IllegalStateException(\"Embedded LDAP server is not provided\");\n\t\t}\n\t\tthis.container = getContainer();\n\t\tthis.port = this.container.getPort();\n\t\tDefaultSpringSecurityContextSource contextSourceFromProviderUrl = new DefaultSpringSecurityContextSource(\n\t\t\t\t\"ldap://127.0.0.1:\" + this.port + \"/\" + this.root);\n\t\tif (this.managerDn != null) {\n\t\t\tcontextSourceFromProviderUrl.setUserDn(this.managerDn);\n\t\t\tif (this.managerPassword == null) {\n\t\t\t\tthrow new IllegalStateException(\"managerPassword is required if managerDn is supplied\");\n\t\t\t}\n\t\t\tcontextSourceFromProviderUrl.setPassword(this.managerPassword);\n\t\t}\n\t\tcontextSourceFromProviderUrl.afterPropertiesSet();\n\t\treturn contextSourceFromProviderUrl;\n\t}\n\n\t@Override\n\tpublic Class<?> getObjectType() {\n\t\treturn DefaultSpringSecurityContextSource.class;\n\t}\n\n\t@Override\n\tpublic void destroy() {\n\t\tif (this.container instanceof Lifecycle) {\n\t\t\t((Lifecycle) this.container).stop();\n\t\t}\n\t}","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/ldap/EmbeddedLdapServerContextSourceFactoryBean.java#L122-L158","documentation":"When building the embedded context source, if a managerDn is supplied to authenticate to the server, a corresponding managerPassword is mandatory; getObject() throws IllegalStateException when the password is null.","triggerScenarios":"Configuring <ldap-server manager-dn=\"cn=admin...\"/> (or the factory bean's setManagerDn) without setting manager-password, then getObject() builds the context source.","commonSituations":"Partial migration from external to embedded LDAP leaving manager-dn set; property placeholder for the password not resolving (yet the DN hardcoded); copying config with credentials omitted for security.","solutions":["Set manager-password alongside manager-dn on <ldap-server/> (or call setManagerPassword on the factory bean).","Remove manager-dn if anonymous binding to the embedded server is sufficient.","Verify password property placeholders resolve at runtime (e.g. ${ldap.password} defined in properties)."],"exampleFix":"// before\n<security:ldap-server ldif=\"classpath:data.ldif\"\n    manager-dn=\"cn=admin,dc=springframework,dc=org\"/>\n\n// after\n<security:ldap-server ldif=\"classpath:data.ldif\"\n    manager-dn=\"cn=admin,dc=springframework,dc=org\"\n    manager-password=\"secret\"/>","handlingStrategy":"validation","validationCode":"if (managerDn != null && managerPassword == null) {\n  throw new IllegalArgumentException(\"manager-password is required when manager-dn is set\");\n}","typeGuard":null,"tryCatchPattern":"try { ctx.refresh(); }\ncatch (IllegalStateException e) {\n  if (e.getMessage().contains(\"managerPassword is required\")) fixManagerPasswordConfig();\n}","preventionTips":["Always pair manager-dn with manager-password in config review","Check that password placeholders resolve (context:property-placeholder)","Drop manager-dn when anonymous binding is fine for embedded servers"],"tags":["spring-security","ldap","config","missing-value"],"backgroundTag":"missing-required-config-field","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}