spring-projects/spring-security · error · BeanDefinitionStoreException

You must supply user definitions, either with <user> child e

Error message

You must supply user definitions, either with <user> child elements or a properties file (using the 'properties' attribute)

What it means

UserServiceBeanDefinitionParser requires at least one source of user definitions. If the <security:user-service> element has neither the 'properties' attribute nor any <user> child elements, there is nothing to build the InMemoryUserDetailsManager from, and doParse throws this BeanDefinitionStoreException during XML parsing.

Source

Thrown at config/src/main/java/org/springframework/security/config/authentication/UserServiceBeanDefinitionParser.java:78

	}

	@Override
	@SuppressWarnings("unchecked")
	protected void doParse(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
		String userProperties = element.getAttribute(ATT_PROPERTIES);
		List<Element> userElts = DomUtils.getChildElementsByTagName(element, ELT_USER);
		if (StringUtils.hasText(userProperties)) {
			if (!CollectionUtils.isEmpty(userElts)) {
				throw new BeanDefinitionStoreException(
						"Use of a properties file and user elements are mutually exclusive");
			}
			BeanDefinition bd = new RootBeanDefinition(PropertiesFactoryBean.class);
			bd.getPropertyValues().addPropertyValue("location", userProperties);
			builder.addConstructorArgValue(bd);
			return;
		}
		if (CollectionUtils.isEmpty(userElts)) {
			throw new BeanDefinitionStoreException("You must supply user definitions, either with <" + ELT_USER
					+ "> child elements or a " + "properties file (using the '" + ATT_PROPERTIES + "' attribute)");
		}
		ManagedList<BeanDefinition> users = new ManagedList<>();
		for (Object elt : userElts) {
			Element userElt = (Element) elt;
			String userName = userElt.getAttribute(ATT_NAME);
			String password = userElt.getAttribute(ATT_PASSWORD);
			if (!StringUtils.hasLength(password)) {
				password = generateRandomPassword();
			}
			boolean locked = "true".equals(userElt.getAttribute(ATT_LOCKED));
			boolean disabled = "true".equals(userElt.getAttribute(ATT_DISABLED));
			BeanDefinitionBuilder authorities = BeanDefinitionBuilder.rootBeanDefinition(AuthorityUtils.class);
			authorities.addConstructorArgValue(userElt.getAttribute(ATT_AUTHORITIES));
			authorities.setFactoryMethod("commaSeparatedStringToAuthorityList");
			BeanDefinitionBuilder user = BeanDefinitionBuilder.rootBeanDefinition(User.class);
			user.addConstructorArgValue(userName);
			user.addConstructorArgValue(password);

View on GitHub (pinned to 96852e8860)

Solutions

1. Add at least one <security:user name=... password=... authorities=.../> child element to <user-service>
2. Or set the properties attribute, e.g. properties="classpath:users.properties"
3. If users are stored elsewhere (DB/LDAP), remove the in-memory user-service and configure a JdbcDaoImpl/LdapAuthenticationProvider instead

Example fix

// before
<security:user-service/>
// after
<security:user-service>
    <security:user name="user" password="{noop}password" authorities="ROLE_USER"/>
</security:user-service>

boolean hasProps = elt.hasAttribute("properties") && !elt.getAttribute("properties").isBlank();
boolean hasUsers = elt.getElementsByTagNameNS("http://www.springframework.org/schema/security", "user").getLength() > 0;
if (!hasProps && !hasUsers) throw new IllegalArgumentException("user-service needs <user> children or a properties attribute");

try {
    ctx = new ClassPathXmlApplicationContext("security.xml");
} catch (BeanDefinitionStoreException e) {
    logger.error("Empty <user-service>: {}", e.getMessage());
}

When it happens

Trigger: A <security:user-service> element (or <security:authentication-provider user-service-ref-less> inline form) appears in the XML with an empty body and no 'properties' attribute; CollectionUtils.isEmpty(userElts) is true and userProperties is blank.

Common situations: Stripping out <user> entries when moving users to a database but leaving the empty element behind; a templating/placeholder transformation removing the attribute value leaving ''; copy-pasting a minimal config snippet without filling in users.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• No id supplied and another bean is already registered as {Be
• Use of a properties file and user elements are mutually excl
• Did you forget to add a global <authentication-manager> elem
• Unknown channel attribute {requiredChannel}
• Could not create CorsFilter

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/8da39912029978bb. Report an issue: GitHub.