spring-projects/spring-security · error · NoUniqueBeanDefinitionException

Expected single matching bean of type 'org.springframework.s

Error message

Expected single matching bean of type 'org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository' but found {}: {}

What it means

When building OAuth2 client support, OAuth2ClientConfigurerUtils looks up an OAuth2AuthorizedClientRepository bean in the ApplicationContext. This IllegalStateException is thrown by getAuthorizedClientRepositoryBean when getBeansOfType finds a number of matching beans other than exactly one (zero or several), because Spring cannot unambiguously pick which repository to use. It fires when no OAuth2AuthorizedClientRepository bean is defined yet a custom one is expected, or when multiple such beans are defined without a primary marker.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurerUtils.java:82

			.getSharedObject(OAuth2AuthorizedClientRepository.class);
		if (authorizedClientRepository == null) {
			authorizedClientRepository = getAuthorizedClientRepositoryBean(builder);
			if (authorizedClientRepository == null) {
				authorizedClientRepository = new AuthenticatedPrincipalOAuth2AuthorizedClientRepository(
						getAuthorizedClientService((builder)));
			}
			builder.setSharedObject(OAuth2AuthorizedClientRepository.class, authorizedClientRepository);
		}
		return authorizedClientRepository;
	}

	private static <B extends HttpSecurityBuilder<B>> OAuth2AuthorizedClientRepository getAuthorizedClientRepositoryBean(
			B builder) {
		Map<String, OAuth2AuthorizedClientRepository> authorizedClientRepositoryMap = BeanFactoryUtils
			.beansOfTypeIncludingAncestors(builder.getSharedObject(ApplicationContext.class),
					OAuth2AuthorizedClientRepository.class);
		if (authorizedClientRepositoryMap.size() > 1) {
			throw new NoUniqueBeanDefinitionException(OAuth2AuthorizedClientRepository.class,
					authorizedClientRepositoryMap.size(),
					"Expected single matching bean of type '" + OAuth2AuthorizedClientRepository.class.getName()
							+ "' but found " + authorizedClientRepositoryMap.size() + ": "
							+ StringUtils.collectionToCommaDelimitedString(authorizedClientRepositoryMap.keySet()));
		}
		return (!authorizedClientRepositoryMap.isEmpty() ? authorizedClientRepositoryMap.values().iterator().next()
				: null);
	}

	private static <B extends HttpSecurityBuilder<B>> OAuth2AuthorizedClientService getAuthorizedClientService(
			B builder) {
		OAuth2AuthorizedClientService authorizedClientService = getAuthorizedClientServiceBean(builder);
		if (authorizedClientService == null) {
			authorizedClientService = new InMemoryOAuth2AuthorizedClientService(
					getClientRegistrationRepository(builder));
		}
		return authorizedClientService;
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Define exactly one OAuth2AuthorizedClientRepository bean, or mark the intended one with @Primary
2. If multiple repositories exist, remove or qualify the redundant beans
3. Provide no bean at all to let the default AuthenticatedPrincipalOAuth2AuthorizedClientRepository/InMemoryOAuth2AuthorizedClientService be used

When it happens

Trigger: Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2ClientConfigurerUtils.java:82 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/1038d6066d707b50. Report an issue: GitHub.