spring-projects/spring-security · error · NoSuchBeanDefinitionException

Did you forget to add a global <authentication-manager> elem

Error message

Did you forget to add a global <authentication-manager> element to your configuration (with child <authentication-provider> elements)? Alternatively you can use the authentication-manager-ref attribute on your <http> and <global-method-security> elements.

What it means

GlobalMethodSecurityBeanDefinitionParser wraps the AuthenticationManager lookup lazily. When no <authentication-manager> (or @EnableGlobalMethodSecurity-provided manager) bean named 'org.springframework.security.authenticationManager' exists in the context, the NoSuchBeanDefinitionException is converted into an informative error telling the user to declare a global authentication manager or use authentication-manager-ref.

Source

Thrown at config/src/main/java/org/springframework/security/config/method/GlobalMethodSecurityBeanDefinitionParser.java:442

		private final String authMgrBean;

		AuthenticationManagerDelegator(String authMgrBean) {
			this.authMgrBean = StringUtils.hasText(authMgrBean) ? authMgrBean : BeanIds.AUTHENTICATION_MANAGER;
		}

		@Override
		public Authentication authenticate(Authentication authentication) throws AuthenticationException {
			synchronized (this.delegateMonitor) {
				if (this.delegate == null) {
					Assert.state(this.beanFactory != null,
							() -> "BeanFactory must be set to resolve " + this.authMgrBean);
					try {
						this.delegate = this.beanFactory.getBean(this.authMgrBean, AuthenticationManager.class);
					}
					catch (NoSuchBeanDefinitionException ex) {
						if (BeanIds.AUTHENTICATION_MANAGER.equals(ex.getBeanName())) {
							throw new NoSuchBeanDefinitionException(BeanIds.AUTHENTICATION_MANAGER,
									AuthenticationManagerFactoryBean.MISSING_BEAN_ERROR_MESSAGE);
						}
						throw ex;
					}
				}
			}
			return this.delegate.authenticate(authentication);
		}

		@Override
		public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
			this.beanFactory = beanFactory;
		}

	}

	static class Jsr250MethodSecurityMetadataSourceBeanFactory extends AbstractGrantedAuthorityDefaultsBeanFactory {

View on GitHub (pinned to 96852e8860)

Solutions

1. Add a global <authentication-manager> element with at least one <authentication-provider> child
2. Set authentication-manager-ref on <global-method-security> (or <http>) pointing to an existing AuthenticationManager bean
3. If using Java config, declare an AuthenticationManager bean (e.g. AuthenticationConfiguration.getAuthenticationManager()) and reference it

Example fix

// before
<global-method-security pre-post-annotations="enabled"/>

// after
<authentication-manager>
  <authentication-provider>
    <user-service>
      <user name="user" password="{noop}password" authorities="ROLE_USER"/>
    </user-service>
  </authentication-provider>
</authentication-manager>
<global-method-security pre-post-annotations="enabled"/>

try {
  ctx.getBean("org.springframework.security.authenticationManager", AuthenticationManager.class);
} catch (NoSuchBeanDefinitionException e) {
  throw new IllegalStateException("Declare <authentication-manager> or set authentication-manager-ref");
}

try {
  authenticationManager.authenticate(authRequest);
} catch (NoSuchBeanDefinitionException e) {
  // define a global authentication-manager or use authentication-manager-ref
  throw new ConfigurationException("Missing <authentication-manager>", e);
}

When it happens

Trigger: Enabling global method security (<global-method-security> or @EnableGlobalMethodSecurity) while the security context defines no AuthenticationManager bean and no authentication-manager-ref points to one; invoking a secured method triggers the lazy authenticate() resolution and fails.

Common situations: Method security enabled in a module with no HTTP security setup; a custom <http> config that never declares <authentication-manager>; refactoring that removed the authentication-provider element.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• org.springframework.security.config.annotation.method.config
• RunAsImplAuthenticationProvider.incorrectKey
• Authenticated principal required to operate with ACLs
• CasAuthenticationProvider.incorrectKey
• Cannot apply {configurer} to already built object

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/9821788901ed1051. Report an issue: GitHub.