spring-projects/spring-security · error · IllegalStateException

org.springframework.security.config.annotation.method.config

Error message

org.springframework.security.config.annotation.method.configuration.ObjectPostProcessor is a required bean. Ensure you have used @org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity

What it means

GlobalMethodSecurityConfiguration requires an ObjectPostProcessor bean to post-process the security objects it builds. The default field value is a stub that always throws; it is only replaced when the Spring context supplies the real ObjectPostProcessor bean, which is registered by @EnableGlobalMethodSecurity. If the configuration class is instantiated without that annotation's import machinery, the stub throws this IllegalStateException.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java:104

 * @author Ngoc Nhan
 * @since 3.2
 * @see EnableGlobalMethodSecurity
 * @deprecated Use {@link PrePostMethodSecurityConfiguration},
 * {@link SecuredMethodSecurityConfiguration}, or
 * {@link Jsr250MethodSecurityConfiguration} instead
 */
@Deprecated
@Configuration(proxyBeanMethods = false)
@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
public class GlobalMethodSecurityConfiguration implements ImportAware, SmartInitializingSingleton, BeanFactoryAware {

	private static final Log logger = LogFactory.getLog(GlobalMethodSecurityConfiguration.class);

	private ObjectPostProcessor<Object> objectPostProcessor = new ObjectPostProcessor<>() {

		@Override
		public <T> T postProcess(T object) {
			throw new IllegalStateException(ObjectPostProcessor.class.getName()
					+ " is a required bean. Ensure you have used @" + EnableGlobalMethodSecurity.class.getName());
		}

	};

	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
		.getContextHolderStrategy();

	private DefaultMethodSecurityExpressionHandler defaultMethodExpressionHandler = new DefaultMethodSecurityExpressionHandler();

	private AuthenticationManager authenticationManager;

	private AuthenticationManagerBuilder auth;

	private boolean disableAuthenticationRegistry;

	private AnnotationAttributes enableMethodSecurity;

View on GitHub (pinned to 96852e8860)

Solutions

1. Annotate one @Configuration class with @EnableGlobalMethodSecurity(prePostEnabled = true) (or @EnableMethodSecurity on Spring Security 5.6+) so the ObjectPostProcessor bean is registered
2. Remove any manual @Bean/@Import of GlobalMethodSecurityConfiguration and let EnableGlobalMethodSecurity import it
3. If building context manually in tests, include the Spring security configuration imports or inject an ObjectPostProcessor bean

Example fix

// before
@Configuration
public class MySecurityConfig extends GlobalMethodSecurityConfiguration { ... }
// after
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MySecurityConfig extends GlobalMethodSecurityConfiguration { ... }

if (!configClass.isAnnotationPresent(EnableGlobalMethodSecurity.class)
        && !configClass.isAnnotationPresent(EnableMethodSecurity.class)) {
    throw new IllegalStateException(
        configClass.getName() + " must be used with @EnableGlobalMethodSecurity or @EnableMethodSecurity");
}

try {
    ctx.refresh();
} catch (BeanCreationException e) {
    if (e.getRootCause() instanceof IllegalStateException ise
            && ise.getMessage().contains("ObjectPostProcessor is a required bean")) {
        throw new IllegalStateException("Add @EnableGlobalMethodSecurity to your configuration", e);
    }
    throw e;
}

When it happens

Trigger: Subclassing or manually registering GlobalMethodSecurityConfiguration without @EnableGlobalMethodSecurity (or @EnableMethodSecurity) driving the import; instantiating the configuration in a test context missing the ObjectPostProcessor bean; using the class in a non-Spring Boot context without the security config infrastructure.

Common situations: Developers copy GlobalMethodSecurityConfiguration into their own @Configuration but forget @EnableGlobalMethodSecurity on any configuration; component-scanning the class directly; custom method-security setups in legacy XML/Java hybrid configs.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• Did you forget to add a global <authentication-manager> elem
• Cannot apply {configurer} to already built object
• managerPassword is required if managerDn is supplied
• AdviceMode '{adviceMode}' is not supported
• The Filter class {registeredFilter.getName()} does not have

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/89ec9b8730e314cf. Report an issue: GitHub.