Spring security warning - Global AuthenticationManager configured with an AuthenticationProvider bean

#77 · closed · 2 comments

View on GitHub ↗

theapplegeek

Hi, I'm using spring 3.3.1 and when run application it show this warning: ``` WARN 31306 --- [main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with an AuthenticationProvider bean. UserDetailsService beans will not be used for username/password login. Consider removing the AuthenticationProvider bean. Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider. ``` How I can fix this? Thx.

Comments

JBraddockm

Remove AuthenticationManager bean from ApplicationConfig. It is my understanding that setting AuthenticationManager like this is not recommended. ``` @Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception { return config.getAuthenticationManager(); } ``` Remove `.authenticationProvider(authenticationProvider)` from SecurityFilterChain in SecurityConfiguration. Now refactor `AuthenticationProvider` bean in ApplicationConfig as follows: ``` @Bean public AuthenticationManager authenticationManager() { DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); authProvider.setUserDetailsService(userDetailsService()); authProvider.setPasswordEncoder(passwordEncoder()); return new ProviderManager(authProvider); } ``` You should now see `Global AuthenticationManager configured with UserDetailsService bean with name userDetailsService` in the log.

theapplegeek

It works, thanks. `ApplicationConfig.java` should be like: ```java @Configuration @AllArgsConstructor public class AuthenticationConfig { private final UserRepository repository; @Bean public UserDetailsService userDetailsService() { return username -> repository .findByUsername(username) .orElseThrow(() -> new UsernameNotFoundException("User not found")); } @Bean public AuthenticationManager authenticationManager() { DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); authProvider.setUserDetailsService(userDetailsService()); authProvider.setPasswordEncoder(passwordEncoder()); return new ProviderManager(authProvider); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } } ```