spring-projects/spring-security · error · ApplicationContextException

No BaseLdapPathContextSource instances found. Have you added

Error message

No BaseLdapPathContextSource instances found. Have you added an <ldap-server /> element to your application context? If you have declared an explicit bean, do not use lazy-init

What it means

ContextSourceSettingPostProcessor.postProcessBeanFactory() requires at least one BaseLdapPathContextSource bean for LDAP configuration. When none is found it throws, hinting that the <ldap-server/> element is missing or the context source bean is lazy and therefore never instantiated.

Source

Thrown at config/src/main/java/org/springframework/security/config/ldap/ContextSourceSettingPostProcessor.java:56

public class ContextSourceSettingPostProcessor implements BeanFactoryPostProcessor, Ordered {

	private static final String REQUIRED_CONTEXT_SOURCE_CLASS_NAME = "org.springframework.ldap.core.support.BaseLdapPathContextSource";

	/**
	 * If set to true, a bean parser has indicated that the default context source name
	 * needs to be set.
	 */
	private boolean defaultNameRequired;

	ContextSourceSettingPostProcessor() {
	}

	@Override
	public void postProcessBeanFactory(ConfigurableListableBeanFactory bf) throws BeansException {
		Class<?> contextSourceClass = getContextSourceClass();
		String[] sources = bf.getBeanNamesForType(contextSourceClass, false, false);
		if (sources.length == 0) {
			throw new ApplicationContextException("No BaseLdapPathContextSource instances found. Have you "
					+ "added an <" + Elements.LDAP_SERVER + " /> element to your application context? If you have "
					+ "declared an explicit bean, do not use lazy-init");
		}
		if (!bf.containsBean(BeanIds.CONTEXT_SOURCE) && this.defaultNameRequired) {
			if (sources.length > 1) {
				throw new ApplicationContextException("More than one BaseLdapPathContextSource instance found. "
						+ "Please specify a specific server id using the 'server-ref' attribute when configuring your <"
						+ Elements.LDAP_PROVIDER + "> " + "or <" + Elements.LDAP_USER_SERVICE + ">.");
			}
			bf.registerAlias(sources[0], BeanIds.CONTEXT_SOURCE);
		}
	}

	private Class<?> getContextSourceClass() throws LinkageError {
		try {
			return ClassUtils.forName(REQUIRED_CONTEXT_SOURCE_CLASS_NAME, ClassUtils.getDefaultClassLoader());
		}
		catch (ClassNotFoundException ex) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Add <ldap-server/> to the configuration (embedded or pointing to ldif).
2. Declare an explicit BaseLdapPathContextSource bean (e.g. DefaultSpringSecurityContextSource) without lazy-init.
3. If a lazy bean is required, set default-lazy-init="false" on it or reference it explicitly via server-ref.

Example fix

// before
<ldap-authentication-provider user-search-filter="(uid={0})" user-search-base="ou=people"/>

// after
<ldap-server url="ldap://localhost:8389/dc=springframework,dc=org"/>
<ldap-authentication-provider user-search-filter="(uid={0})" user-search-base="ou=people"/>

String[] names = bf.getBeanNamesForType(BaseLdapPathContextSource.class, false, false);
if (names.length == 0) {
  throw new IllegalStateException("Add <ldap-server/> or a non-lazy BaseLdapPathContextSource bean");
}

try { ctx.refresh(); }
catch (ApplicationContextException e) {
  if (e.getMessage().contains("No BaseLdapPathContextSource")) log.error("Missing <ldap-server/>");
}

When it happens

Trigger: Using <ldap-authentication-provider/>, <ldap-user-service/>, or related LDAP elements without any BaseLdapPathContextSource bean present (no <ldap-server/> and no explicit context source bean, or the explicit bean is lazy-init so it isn't registered/instantiable eagerly).

Common situations: Forgetting <ldap-server/> while using <ldap-authentication-provider/>; declaring a DefaultSpringSecurityContextSource bean with lazy-init="true"; LDAP elements retained after removing the embedded server.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• No UserDetailsService registered.
• More than one BaseLdapPathContextSource instance found. Plea
• managerPassword is required if managerDn is supplied
• managerPassword is required if managerDn is supplied
• No RSocketSecurity defined

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/e9f43b428b6b22af. Report an issue: GitHub.