{"record":{"id":"9821788901ed1051","repo":"spring-projects/spring-security","slug":"did-you-forget-to-add-a-global-authentication-man-982178","errorCode":null,"errorMessage":"Did you forget to add a global <authentication-manager> element to your configuration (with child <authentication-provider> elements)? Alternatively you can use the authentication-manager-ref attribute on your <http> and <global-method-security> elements.","messagePattern":"Did you forget to add a global <authentication-manager> element to your configuration \\(with child <authentication-provider> elements\\)\\? Alternatively you can use the authentication-manager-ref attribute on your <http> and <global-method-security> elements\\.","errorType":"exception","errorClass":"NoSuchBeanDefinitionException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/method/GlobalMethodSecurityBeanDefinitionParser.java","lineNumber":442,"sourceCode":"\n\t\tprivate final String authMgrBean;\n\n\t\tAuthenticationManagerDelegator(String authMgrBean) {\n\t\t\tthis.authMgrBean = StringUtils.hasText(authMgrBean) ? authMgrBean : BeanIds.AUTHENTICATION_MANAGER;\n\t\t}\n\n\t\t@Override\n\t\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\t\tsynchronized (this.delegateMonitor) {\n\t\t\t\tif (this.delegate == null) {\n\t\t\t\t\tAssert.state(this.beanFactory != null,\n\t\t\t\t\t\t\t() -> \"BeanFactory must be set to resolve \" + this.authMgrBean);\n\t\t\t\t\ttry {\n\t\t\t\t\t\tthis.delegate = this.beanFactory.getBean(this.authMgrBean, AuthenticationManager.class);\n\t\t\t\t\t}\n\t\t\t\t\tcatch (NoSuchBeanDefinitionException ex) {\n\t\t\t\t\t\tif (BeanIds.AUTHENTICATION_MANAGER.equals(ex.getBeanName())) {\n\t\t\t\t\t\t\tthrow new NoSuchBeanDefinitionException(BeanIds.AUTHENTICATION_MANAGER,\n\t\t\t\t\t\t\t\t\tAuthenticationManagerFactoryBean.MISSING_BEAN_ERROR_MESSAGE);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthrow ex;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn this.delegate.authenticate(authentication);\n\t\t}\n\n\t\t@Override\n\t\tpublic void setBeanFactory(BeanFactory beanFactory) throws BeansException {\n\t\t\tthis.beanFactory = beanFactory;\n\t\t}\n\n\t}\n\n\tstatic class Jsr250MethodSecurityMetadataSourceBeanFactory extends AbstractGrantedAuthorityDefaultsBeanFactory {\n","sourceCodeStart":424,"sourceCodeEnd":460,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/method/GlobalMethodSecurityBeanDefinitionParser.java#L424-L460","documentation":"GlobalMethodSecurityBeanDefinitionParser wraps the AuthenticationManager lookup lazily. When no <authentication-manager> (or @EnableGlobalMethodSecurity-provided manager) bean named 'org.springframework.security.authenticationManager' exists in the context, the NoSuchBeanDefinitionException is converted into an informative error telling the user to declare a global authentication manager or use authentication-manager-ref.","triggerScenarios":"Enabling global method security (<global-method-security> or @EnableGlobalMethodSecurity) while the security context defines no AuthenticationManager bean and no authentication-manager-ref points to one; invoking a secured method triggers the lazy authenticate() resolution and fails.","commonSituations":"Method security enabled in a module with no HTTP security setup; a custom <http> config that never declares <authentication-manager>; refactoring that removed the authentication-provider element.","solutions":["Add a global <authentication-manager> element with at least one <authentication-provider> child","Set authentication-manager-ref on <global-method-security> (or <http>) pointing to an existing AuthenticationManager bean","If using Java config, declare an AuthenticationManager bean (e.g. AuthenticationConfiguration.getAuthenticationManager()) and reference it"],"exampleFix":"// before\n<global-method-security pre-post-annotations=\"enabled\"/>\n\n// after\n<authentication-manager>\n  <authentication-provider>\n    <user-service>\n      <user name=\"user\" password=\"{noop}password\" authorities=\"ROLE_USER\"/>\n    </user-service>\n  </authentication-provider>\n</authentication-manager>\n<global-method-security pre-post-annotations=\"enabled\"/>","handlingStrategy":"validation","validationCode":"try {\n  ctx.getBean(\"org.springframework.security.authenticationManager\", AuthenticationManager.class);\n} catch (NoSuchBeanDefinitionException e) {\n  throw new IllegalStateException(\"Declare <authentication-manager> or set authentication-manager-ref\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  authenticationManager.authenticate(authRequest);\n} catch (NoSuchBeanDefinitionException e) {\n  // define a global authentication-manager or use authentication-manager-ref\n  throw new ConfigurationException(\"Missing <authentication-manager>\", e);\n}","preventionTips":["Declare an <authentication-manager> with a provider whenever method security is enabled","Prefer @EnableGlobalAuthentication/@EnableMethodSecurity with an AuthenticationManager bean","Wire authentication-manager-ref explicitly rather than relying on the default bean name"],"tags":["spring-security","authentication","configuration","method-security"],"backgroundTag":"missing-required-config","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}