Introduction

Since WebSecurityConfigurerAdapter was deprecated and removed from the usual configuration style, exposing an AuthenticationManager in Spring Security is now done with beans instead of inheritance. The exact approach depends on whether you want the framework-managed AuthenticationManager or a custom one built from specific authentication providers.

The important shift is conceptual: configure security explicitly with SecurityFilterChain, provider beans, and, when needed, an AuthenticationManager bean derived from AuthenticationConfiguration.

The Simple Way: Ask Spring for It

If Spring Security already knows how to build the authentication manager from your configured providers, the usual approach is:

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.authentication.AuthenticationManager;
4import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
5
6@Configuration
7public class SecurityBeans {
8
9    @Bean
10    AuthenticationManager authenticationManager(AuthenticationConfiguration configuration) throws Exception {
11        return configuration.getAuthenticationManager();
12    }
13}

This is the most common answer when you need to inject AuthenticationManager into a login service or custom authentication endpoint.

Pair It with SecurityFilterChain

Modern Spring Security configuration usually looks like this:

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.Customizer;
4import org.springframework.security.config.annotation.web.builders.HttpSecurity;
5import org.springframework.security.web.SecurityFilterChain;
6
7@Configuration
8public class SecurityConfig {
9
10    @Bean
11    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
12        http
13            .authorizeHttpRequests(auth -> auth
14                .requestMatchers("/login").permitAll()
15                .anyRequest().authenticated()
16            )
17            .formLogin(Customizer.withDefaults());
18
19        return http.build();
20    }
21}

This replaces the old adapter-based override style.

Expose Providers and UserDetails Explicitly

If you want Spring to assemble the manager correctly, provide the pieces as beans.

1import org.springframework.context.annotation.Bean;
2import org.springframework.security.core.userdetails.User;
3import org.springframework.security.core.userdetails.UserDetailsService;
4import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
5import org.springframework.security.crypto.password.PasswordEncoder;
6import org.springframework.security.provisioning.InMemoryUserDetailsManager;
7
8@Bean
9UserDetailsService userDetailsService(PasswordEncoder encoder) {
10    return new InMemoryUserDetailsManager(
11        User.withUsername("user")
12            .password(encoder.encode("password"))
13            .roles("USER")
14            .build()
15    );
16}
17
18@Bean
19PasswordEncoder passwordEncoder() {
20    return new BCryptPasswordEncoder();
21}

With these in place, AuthenticationConfiguration can usually build the right manager for you.

When You Need a Custom AuthenticationManager

If you want full control, create one from providers yourself.

1import org.springframework.context.annotation.Bean;
2import org.springframework.security.authentication.AuthenticationManager;
3import org.springframework.security.authentication.ProviderManager;
4import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
5
6@Bean
7AuthenticationManager authenticationManager(UserDetailsService userDetailsService,
8                                            PasswordEncoder passwordEncoder) {
9    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
10    provider.setUserDetailsService(userDetailsService);
11    provider.setPasswordEncoder(passwordEncoder);
12    return new ProviderManager(provider);
13}

This is useful when you need a very specific provider chain or nonstandard authentication flow.

Common Use Case: Login Service

A typical reason to expose the bean is manual authentication in a REST login endpoint.

Authentication auth = authenticationManager.authenticate(
    new UsernamePasswordAuthenticationToken(username, password)
);

That still works in the modern component-based style; you just obtain the manager through bean configuration rather than overriding adapter methods.

Testing and Boot Integration

In Spring Boot applications, this bean-based style also makes tests easier to reason about because each security component is explicit. You can replace the UserDetailsService, PasswordEncoder, or even the AuthenticationManager itself in test configuration without subclassing a global adapter.

That is one of the practical benefits of the newer model: fewer magic overrides and more ordinary Spring bean wiring.

Common Pitfalls

The biggest mistake is trying to keep using WebSecurityConfigurerAdapter patterns mentally even after moving to the bean-based approach.

Another common issue is exposing AuthenticationManager from AuthenticationConfiguration without actually registering the providers, UserDetailsService, or password encoder that Spring needs.

People also create a custom AuthenticationManager unnecessarily when the framework can already build one from the configured authentication components.

Finally, do not forget that SecurityFilterChain and authentication-manager exposure solve different concerns. One configures the web filter behavior; the other gives you programmatic access to authentication.

Summary

• Modern Spring Security exposes AuthenticationManager through beans, not WebSecurityConfigurerAdapter.
• The simplest pattern is configuration.getAuthenticationManager().
• Use SecurityFilterChain for HTTP security configuration.
• Provide UserDetailsService, providers, and password encoders as beans.
• Build a custom ProviderManager only when you need explicit control.
• Treat filter-chain configuration and authentication-manager exposure as separate responsibilities.