{"record":{"id":"c23d9817491cd698","repo":"spring-projects/spring-security","slug":"use-of-a-properties-file-and-user-elements-are-mut","errorCode":null,"errorMessage":"Use of a properties file and user elements are mutually exclusive","messagePattern":"Use of a properties file and user elements are mutually exclusive","errorType":"exception","errorClass":"BeanDefinitionStoreException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java","lineNumber":69,"sourceCode":"\tstatic final String ATT_PROPERTIES = \"properties\";\n\tstatic final String ATT_DISABLED = \"disabled\";\n\tstatic final String ATT_LOCKED = \"locked\";\n\n\tprivate SecureRandom random;\n\n\t@Override\n\tprotected String getBeanClassName(Element element) {\n\t\treturn InMemoryUserDetailsManager.class.getName();\n\t}\n\n\t@Override\n\t@SuppressWarnings(\"unchecked\")\n\tprotected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {\n\t\tString userProperties = element.getAttribute(ATT_PROPERTIES);\n\t\tList<Element> userElts = DomUtils.getChildElementsByTagName(element, ELT_USER);\n\t\tif (StringUtils.hasText(userProperties)) {\n\t\t\tif (!CollectionUtils.isEmpty(userElts)) {\n\t\t\t\tthrow new BeanDefinitionStoreException(\n\t\t\t\t\t\t\"Use of a properties file and user elements are mutually exclusive\");\n\t\t\t}\n\t\t\tBeanDefinition bd = new RootBeanDefinition(PropertiesFactoryBean.class);\n\t\t\tbd.getPropertyValues().addPropertyValue(\"location\", userProperties);\n\t\t\tbuilder.addConstructorArgValue(bd);\n\t\t\treturn;\n\t\t}\n\t\tif (CollectionUtils.isEmpty(userElts)) {\n\t\t\tthrow new BeanDefinitionStoreException(\"You must supply user definitions, either with <\" + ELT_USER\n\t\t\t\t\t+ \"> child elements or a \" + \"properties file (using the '\" + ATT_PROPERTIES + \"' attribute)\");\n\t\t}\n\t\tManagedList<BeanDefinition> users = new ManagedList<>();\n\t\tfor (Object elt : userElts) {\n\t\t\tElement userElt = (Element) elt;\n\t\t\tString userName = userElt.getAttribute(ATT_NAME);\n\t\t\tString password = userElt.getAttribute(ATT_PASSWORD);\n\t\t\tif (!StringUtils.hasLength(password)) {\n\t\t\t\tpassword = generateRandomPassword();","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java#L51-L87","documentation":"UserServiceBeanDefinitionParser parses the <security:user-service> XML element into an InMemoryUserDetailsManager. A user service may be populated either from a properties resource (the 'properties' attribute) or from inline <user> child elements, but not both at once; supplying both would make the user source ambiguous, so parsing aborts with this BeanDefinitionStoreException at context startup.","triggerScenarios":"A <security:user-service> element declares both a non-empty 'properties' attribute and at least one <user> child element; detected in doParse when StringUtils.hasText(userProperties) is true and the <user> child list is non-empty.","commonSituations":"Merging XML config from two sources (e.g. one fragment adds a properties file while another appends <user> elements); converting a properties-based config to inline users without removing the attribute; copy-paste boilerplate that keeps both attributes.","solutions":["Remove either the 'properties' attribute or all <user> child elements from the <user-service> element so only one source remains","If users come from an external file, move all credentials into that properties file and delete the <user> children","If users are inline, delete the properties attribute and define each account with <user name=... password=... authorities=.../>","Consider replacing the XML user-service entirely with a UserDetailsService @Bean for programmatic control"],"exampleFix":"// before\n<security:user-service properties=\"classpath:users.properties\">\n    <security:user name=\"admin\" password=\"{noop}pw\" authorities=\"ROLE_ADMIN\"/>\n</security:user-service>\n// after\n<security:user-service properties=\"classpath:users.properties\"/>","handlingStrategy":"validation","validationCode":"Element elt = ...; boolean hasProps = elt.hasAttribute(\"properties\") && !elt.getAttribute(\"properties\").isBlank();\nboolean hasUsers = ((Element) elt).getElementsByTagNameNS(\"http://www.springframework.org/schema/security\", \"user\").getLength() > 0;\nif (hasProps && hasUsers) throw new IllegalArgumentException(\"user-service: properties attribute and <user> elements are mutually exclusive\");","typeGuard":null,"tryCatchPattern":"// wrap context startup\ntry {\n    new ClassPathXmlApplicationContext(\"security.xml\");\n} catch (BeanDefinitionStoreException e) {\n    logger.error(\"Invalid <user-service> config: {}\", e.getMessage());\n}","preventionTips":["Keep a single user source per <user-service> element","Review merged XML fragments for duplicate user sources","Prefer a UserDetailsService bean over XML user-service for complex setups"],"tags":["spring-security","xml-config","bean-definition","conflict"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}