spring-projects/spring-security · warning

Could not validate configuration attributes as the SecurityM

Error message

Could not validate configuration attributes as the SecurityMetadataSource did not return any attributes from getAllConfigAttributes()

What it means

AbstractSecurityInterceptor.afterPropertiesSet validates that all ConfigAttributes returned by the SecurityMetadataSource are understood by the AccessDecisionManager/AuthorizationManager and AfterInvocationManager. If obtainSecurityMetadataSource().getAllConfigAttributes() returns null, attribute validation cannot run and a WARN is logged instead, so misconfigured attributes would go undetected. It is a warning about skipped validation, not a hard failure.

Source

Thrown at access/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java:170

		Assert.notNull(this.messages, "A message source must be set");
		Assert.notNull(this.authenticationManager, "An AuthenticationManager is required");
		Assert.notNull(this.accessDecisionManager, "An AccessDecisionManager is required");
		Assert.notNull(this.runAsManager, "A RunAsManager is required");
		Assert.notNull(this.obtainSecurityMetadataSource(), "An SecurityMetadataSource is required");
		Assert.isTrue(this.obtainSecurityMetadataSource().supports(getSecureObjectClass()),
				() -> "SecurityMetadataSource does not support secure object class: " + getSecureObjectClass());
		Assert.isTrue(this.runAsManager.supports(getSecureObjectClass()),
				() -> "RunAsManager does not support secure object class: " + getSecureObjectClass());
		Assert.isTrue(this.accessDecisionManager.supports(getSecureObjectClass()),
				() -> "AccessDecisionManager does not support secure object class: " + getSecureObjectClass());
		if (this.afterInvocationManager != null) {
			Assert.isTrue(this.afterInvocationManager.supports(getSecureObjectClass()),
					() -> "AfterInvocationManager does not support secure object class: " + getSecureObjectClass());
		}
		if (this.validateConfigAttributes) {
			Collection<ConfigAttribute> attributeDefs = this.obtainSecurityMetadataSource().getAllConfigAttributes();
			if (attributeDefs == null) {
				this.logger.warn("Could not validate configuration attributes as the "
						+ "SecurityMetadataSource did not return any attributes from getAllConfigAttributes()");
				return;
			}
			validateAttributeDefs(attributeDefs);
		}
	}

	private void validateAttributeDefs(Collection<ConfigAttribute> attributeDefs) {
		Set<ConfigAttribute> unsupportedAttrs = new HashSet<>();
		for (ConfigAttribute attr : attributeDefs) {
			if (!this.runAsManager.supports(attr) && !this.accessDecisionManager.supports(attr)
					&& ((this.afterInvocationManager == null) || !this.afterInvocationManager.supports(attr))) {
				unsupportedAttrs.add(attr);
			}
		}
		if (unsupportedAttrs.size() != 0) {
			this.logger
				.trace("Did not validate configuration attributes since validateConfigurationAttributes is false");

View on GitHub (pinned to 96852e8860)

Solutions

1. Implement getAllConfigAttributes() in the custom SecurityMetadataSource to return the full set of attributes (return an empty collection rather than null if enumeration is intentionally skipped).
2. Return Collections.emptyList() when there are no enumerable attributes, so validation proceeds harmlessly.
3. Alternatively set validateConfigAttributes=false on the interceptor if validation is not applicable.
4. If attributes come from a static source, switch to the framework-provided implementations that support enumeration.

Example fix

// before
@Override
public Collection<ConfigAttribute> getAllConfigAttributes() {
    return null; // triggers warning, validation skipped
}
// after
@Override
public Collection<ConfigAttribute> getAllConfigAttributes() {
    return Collections.emptyList();
}

// check the metadata source enumerates attributes at startup
Collection<ConfigAttribute> attrs =
    securityMetadataSource.getAllConfigAttributes();
if (attrs == null) {
    throw new IllegalStateException(
        "getAllConfigAttributes() must not return null");
}

When it happens

Trigger: Calling afterPropertiesSet (bean initialization of any security interceptor, e.g. FilterSecurityInterceptor/MethodSecurityInterceptor) with validateConfigAttributes=true and a SecurityMetadataSource whose getAllConfigAttributes() returns null.

Common situations: Custom SecurityMetadataSource implementations that do not (or cannot) enumerate attributes at startup; dynamic/attribute-at-lookup-time sources returning null; wiring interceptors manually rather than via the namespace/DSL which sets a validating source.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Invalid Client Registration: + fieldName
• Expression was null but expected boolean result '{expression
• Failed to evaluate expression '{expressionString}'
• The class with {id} and name of {className} is not in the al
• keyLength must be greater than 0

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/320e956bf1a8ab73. Report an issue: GitHub.