Introduction

This Spring Boot startup error means something is trying to inject AuthenticationManager, but Spring does not currently expose one as a bean in your application context. The fix depends on your Spring Security generation: modern Boot applications usually define the bean through AuthenticationConfiguration, while older applications used WebSecurityConfigurerAdapter.

Why the Error Appears

A common pattern is an authentication service that calls authenticate(...) directly.

1import org.springframework.security.authentication.AuthenticationManager;
2import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
3import org.springframework.security.core.Authentication;
4import org.springframework.stereotype.Service;
5
6@Service
7public class LoginService {
8    private final AuthenticationManager authenticationManager;
9
10    public LoginService(AuthenticationManager authenticationManager) {
11        this.authenticationManager = authenticationManager;
12    }
13
14    public Authentication login(String username, String password) {
15        return authenticationManager.authenticate(
16            new UsernamePasswordAuthenticationToken(username, password)
17        );
18    }
19}

That service is fine, but it assumes an AuthenticationManager bean exists. In Spring Security 5.7 and later, the framework no longer exposes that bean automatically just because you enabled web security.

Modern Fix for Spring Boot 3 and Spring Security 6

In current Spring Boot applications, define an AuthenticationManager bean by asking AuthenticationConfiguration for the manager Spring already knows how to build.

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.authentication.AuthenticationManager;
4import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
5import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6import org.springframework.security.web.SecurityFilterChain;
7
8@Configuration
9public class SecurityConfig {
10    @Bean
11    public AuthenticationManager authenticationManager(
12            AuthenticationConfiguration configuration) throws Exception {
13        return configuration.getAuthenticationManager();
14    }
15
16    @Bean
17    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
18        http
19            .csrf(csrf -> csrf.disable())
20            .authorizeHttpRequests(auth -> auth
21                .requestMatchers("/login").permitAll()
22                .anyRequest().authenticated()
23            );
24        return http.build();
25    }
26}

This works because Spring Security assembles the manager from your configured authentication providers, UserDetailsService, and password encoder.

Make Sure Supporting Beans Exist

Exposing the manager is not enough if the underlying authentication pieces are missing. A typical username-password setup also needs a UserDetailsService and PasswordEncoder.

1import org.springframework.context.annotation.Bean;
2import org.springframework.security.core.userdetails.User;
3import org.springframework.security.core.userdetails.UserDetailsService;
4import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
5import org.springframework.security.crypto.password.PasswordEncoder;
6import org.springframework.security.provisioning.InMemoryUserDetailsManager;
7
8@Bean
9public UserDetailsService userDetailsService(PasswordEncoder encoder) {
10    return new InMemoryUserDetailsManager(
11        User.withUsername("demo")
12            .password(encoder.encode("secret"))
13            .roles("USER")
14            .build()
15    );
16}
17
18@Bean
19public PasswordEncoder passwordEncoder() {
20    return new BCryptPasswordEncoder();
21}

If those beans are absent or inconsistent, the application may start but authentication will still fail at runtime.

Legacy Fix for Older Spring Boot Versions

If you are maintaining Spring Boot 2.x code that still uses WebSecurityConfigurerAdapter, the historical pattern was to override authenticationManagerBean().

1@Override
2@Bean
3public AuthenticationManager authenticationManagerBean() throws Exception {
4    return super.authenticationManagerBean();
5}

That pattern is legacy now. Use it only when you are intentionally staying on the older stack.

When You Might Not Need the Bean

In some applications, nothing in your code needs to inject AuthenticationManager directly. If you rely entirely on Spring Security filters for form login, HTTP Basic, or bearer-token authentication, exposing the bean may be unnecessary. The error appears only when your own component asks for it through constructor injection or field injection.

That distinction is useful when cleaning up configuration. Sometimes the better fix is not to add another bean, but to remove a service dependency that duplicates what the filter chain already does. Keep direct AuthenticationManager usage for explicit programmatic login flows, custom authentication endpoints, or tests that truly need it.

Common Pitfalls

• Injecting AuthenticationManager and assuming Spring will expose it automatically in every version. That changed in newer Spring Security releases.
• Defining the manager bean but forgetting UserDetailsService or PasswordEncoder, which moves the failure from startup to runtime.
• Copying WebSecurityConfigurerAdapter examples into a Spring Boot 3 project. Those examples target an older API generation.
• Building a custom AuthenticationProvider but never registering it, leaving the manager with no provider that can authenticate your token.
• Mixing multiple security configurations without understanding bean precedence. That can produce confusing startup behavior.

Summary

• The error means AuthenticationManager is being injected but not exposed as a bean.
• In modern Spring Security, declare it with AuthenticationConfiguration.getAuthenticationManager().
• Ensure the supporting authentication beans are also configured.
• Use legacy authenticationManagerBean() only for older Boot codebases.
• Match the fix to your Spring Security version instead of mixing examples from different generations.