spring-projects/spring-security · error · IllegalStateException

managerPassword is required if managerDn is supplied

Error message

managerPassword is required if managerDn is supplied

What it means

When building the embedded context source, if a managerDn is supplied to authenticate to the server, a corresponding managerPassword is mandatory; getObject() throws IllegalStateException when the password is null.

Source

Thrown at config/src/main/java/org/springframework/security/config/ldap/EmbeddedLdapServerContextSourceFactoryBean.java:140

	 * @param managerPassword password for the manager DN
	 */
	public void setManagerPassword(String managerPassword) {
		this.managerPassword = managerPassword;
	}

	@Override
	public DefaultSpringSecurityContextSource getObject() throws Exception {
		if (!unboundIdPresent) {
			throw new IllegalStateException("Embedded LDAP server is not provided");
		}
		this.container = getContainer();
		this.port = this.container.getPort();
		DefaultSpringSecurityContextSource contextSourceFromProviderUrl = new DefaultSpringSecurityContextSource(
				"ldap://127.0.0.1:" + this.port + "/" + this.root);
		if (this.managerDn != null) {
			contextSourceFromProviderUrl.setUserDn(this.managerDn);
			if (this.managerPassword == null) {
				throw new IllegalStateException("managerPassword is required if managerDn is supplied");
			}
			contextSourceFromProviderUrl.setPassword(this.managerPassword);
		}
		contextSourceFromProviderUrl.afterPropertiesSet();
		return contextSourceFromProviderUrl;
	}

	@Override
	public Class<?> getObjectType() {
		return DefaultSpringSecurityContextSource.class;
	}

	@Override
	public void destroy() {
		if (this.container instanceof Lifecycle) {
			((Lifecycle) this.container).stop();
		}
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Set manager-password alongside manager-dn on <ldap-server/> (or call setManagerPassword on the factory bean).
2. Remove manager-dn if anonymous binding to the embedded server is sufficient.
3. Verify password property placeholders resolve at runtime (e.g. ${ldap.password} defined in properties).

Example fix

// before
<security:ldap-server ldif="classpath:data.ldif"
    manager-dn="cn=admin,dc=springframework,dc=org"/>

// after
<security:ldap-server ldif="classpath:data.ldif"
    manager-dn="cn=admin,dc=springframework,dc=org"
    manager-password="secret"/>

if (managerDn != null && managerPassword == null) {
  throw new IllegalArgumentException("manager-password is required when manager-dn is set");
}

try { ctx.refresh(); }
catch (IllegalStateException e) {
  if (e.getMessage().contains("managerPassword is required")) fixManagerPasswordConfig();
}

When it happens

Trigger: Configuring <ldap-server manager-dn="cn=admin..."/> (or the factory bean's setManagerDn) without setting manager-password, then getObject() builds the context source.

Common situations: Partial migration from external to embedded LDAP leaving manager-dn set; property placeholder for the password not resolving (yet the DN hardcoded); copying config with credentials omitted for security.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• No BaseLdapPathContextSource instances found. Have you added
• More than one BaseLdapPathContextSource instance found. Plea
• managerPassword is required if managerDn is supplied
• Bean '{name}' must be a UserDetailsService or an Authenticat
• No UserDetailsService registered.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8e8769aefec7c8bc. Report an issue: GitHub.