title: Spring Security 3.2 code based configuration. Form login + global method security
body: <p>I'm upgrading Spring security from 3.1 to 3.2 in my project. Since 3.2 supports code based configurations I have decided to convert old XML based configuration to Java code.</p>
  
  <p>I receive the exception said that no bean with name <code>"authenticationManager"</code> has been found every time I try to start an application. This exception start appearing after <code>@EnableGlobalMethodSecurity</code> annotation been added to the configuration class.</p>
  
  <p><strong>Spring framework version</strong>: 4.0.0.RELEASE</p>
  
  <p><strong>Spring security version</strong>: 3.2.0.RELEASE</p>
  
  <p>Old Xml config looks like that:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="
                                   http://www.springframework.org/schema/beans
                                   http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
                                   http://www.springframework.org/schema/security
                                   http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
    &lt;global-method-security secured-annotations="enabled"
                          jsr250-annotations="enabled"
                          pre-post-annotations="enabled"
                          proxy-target-class="true"/&gt;
  
    &lt;http auto-config="true" use-expressions="true" &gt;
      &lt;form-login login-page="/login" 
                  default-target-url="/home" 
                  authentication-failure-url = "/login?login_error=1" /&gt;
  
      &lt;logout logout-url="/logout" logout-success-url="/index" /&gt;
    &lt;/http&gt;
  
    &lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref="authUserDetailService"&gt;
        &lt;password-encoder hash="plaintext"/&gt;
      &lt;/authentication-provider&gt;
    &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>New Java config class looks like that:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(securedEnabled = true)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER").and()
                  .withUser("admin").password("password").roles("USER", "ADMIN");
      }
  
      @Bean
      public UserDetailsService userDetailsServiceBean() {
          return new UserDetailsService() {
              private final Logger logger = LoggerFactory.getLogger(UserDetailsService.class);
  
              @Override
              public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
                  List&lt;GrantedAuthority&gt; list = new ArrayList&lt;&gt;();
                  String login = null;
                  String password = null;
  
                  logger.debug("Started loading user by name: " + username);
                  if (username.equals("admin")) {
                      login = "admin";
                      password = "admin";
                      list.add(new SimpleGrantedAuthority("ROLE_USER"));
                      list.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
                  }
  
                  if (username.equals("user")) {
                      login = "user";
                      password = "user";
                      list.add(new SimpleGrantedAuthority("ROLE_USER"));
                  }
                  logger.debug("User " + username + ": " + login + ", " + password);
  
                  return new User(login, password, true, true, true, true, list);
              }
          };
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .formLogin()
                  .loginPage("/login")
                  .failureUrl("/login?login_error=1")
                  .defaultSuccessUrl("/home")
                  .and()
              .logout()
                  .logoutUrl("/logout")
                  .logoutSuccessUrl("/index");
      }
  }
  </code></pre>
  
  <p>Text of exception:</p>
  
  <pre><code>org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'webAppFrontController' defined in file [/mnt/data/Docs/IdeaProjects/test/target/test/WEB-INF/classes/sample/web/controllers/WebAppFrontController.class]: Initialization of bean failed; nested exception is org.springframework.aop.framework.AopConfigException: Unexpected AOP exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'methodSecurityInterceptor' defined in class path resource [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class]: Instantiation of bean failed; nested exception is org.springframework.beans.factory.BeanDefinitionStoreException: Factory method [public org.aopalliance.intercept.MethodInterceptor org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.methodSecurityInterceptor() throws java.lang.Exception] threw exception; nested exception is java.lang.IllegalArgumentException: Expecting to only find a single bean for type interface org.springframework.security.authentication.AuthenticationManager, but found []
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:529)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:458)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:295)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:292)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
      at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:626)
      at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:932)
      at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:479)
      at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:389)
      at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:294)
      at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:112)
      at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4937)
      at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5434)
      at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
      at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
      at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
      at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:633)
      at org.apache.catalina.startup.HostConfig.manageApp(HostConfig.java:1551)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:301)
      at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
      at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
      at org.apache.catalina.mbeans.MBeanFactory.createStandardContext(MBeanFactory.java:622)
      at org.apache.catalina.mbeans.MBeanFactory.createStandardContext(MBeanFactory.java:569)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:301)
      at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
      at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
      at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1487)
      at javax.management.remote.rmi.RMIConnectionImpl.access$300(RMIConnectionImpl.java:97)
      at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMIConnectionImpl.java:1328)
      at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConnectionImpl.java:1420)
      at javax.management.remote.rmi.RMIConnectionImpl.invoke(RMIConnectionImpl.java:848)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:322)
      at sun.rmi.transport.Transport$1.run(Transport.java:177)
      at sun.rmi.transport.Transport$1.run(Transport.java:174)
      at java.security.AccessController.doPrivileged(Native Method)
      at sun.rmi.transport.Transport.serviceCall(Transport.java:173)
      at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:556)
      at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(TCPTransport.java:811)
      at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:670)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      at java.lang.Thread.run(Thread.java:744)
  Caused by: org.springframework.aop.framework.AopConfigException: Unexpected AOP exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'methodSecurityInterceptor' defined in class path resource [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class]: Instantiation of bean failed; nested exception is org.springframework.beans.factory.BeanDefinitionStoreException: Factory method [public org.aopalliance.intercept.MethodInterceptor org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.methodSecurityInterceptor() throws java.lang.Exception] threw exception; nested exception is java.lang.IllegalArgumentException: Expecting to only find a single bean for type interface org.springframework.security.authentication.AuthenticationManager, but found []
      at org.springframework.aop.framework.CglibAopProxy.getProxy(CglibAopProxy.java:224)
      at org.springframework.aop.framework.ProxyFactory.getProxy(ProxyFactory.java:111)
      at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.createProxy(AbstractAutoProxyCreator.java:477)
      at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.wrapIfNecessary(AbstractAutoProxyCreator.java:362)
      at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.postProcessAfterInitialization(AbstractAutoProxyCreator.java:322)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsAfterInitialization(AbstractAutowireCapableBeanFactory.java:409)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1488)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:521)
      ... 54 more
  Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'methodSecurityInterceptor' defined in class path resource [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class]: Instantiation of bean failed; nested exception is org.springframework.beans.factory.BeanDefinitionStoreException: Factory method [public org.aopalliance.intercept.MethodInterceptor org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.methodSecurityInterceptor() throws java.lang.Exception] threw exception; nested exception is java.lang.IllegalArgumentException: Expecting to only find a single bean for type interface org.springframework.security.authentication.AuthenticationManager, but found []
      at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:581)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1025)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:921)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:487)
      at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:458)
      at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:295)
      at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223)
      at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:292)
      at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:198)
      at org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor.getAdvice(MethodSecurityMetadataSourceAdvisor.java:96)
      at org.springframework.aop.framework.CglibAopProxy$ProxyCallbackFilter.hashCode(CglibAopProxy.java:916)
      at org.springframework.cglib.proxy.Enhancer$EnhancerKey$$KeyFactoryByCGLIB$$4ce19e8f.hashCode(&lt;generated&gt;)
      at java.util.HashMap.hash(HashMap.java:366)
      at java.util.HashMap.getEntry(HashMap.java:466)
      at java.util.HashMap.get(HashMap.java:421)
      at org.springframework.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:199)
      at org.springframework.cglib.proxy.Enhancer.createHelper(Enhancer.java:377)
      at org.springframework.cglib.proxy.Enhancer.create(Enhancer.java:285)
      at org.springframework.aop.framework.CglibAopProxy.getProxy(CglibAopProxy.java:205)
      ... 61 more
  Caused by: org.springframework.beans.factory.BeanDefinitionStoreException: Factory method [public org.aopalliance.intercept.MethodInterceptor org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.methodSecurityInterceptor() throws java.lang.Exception] threw exception; nested exception is java.lang.IllegalArgumentException: Expecting to only find a single bean for type interface org.springframework.security.authentication.AuthenticationManager, but found []
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:181)
      at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:570)
      ... 79 more
  Caused by: java.lang.IllegalArgumentException: Expecting to only find a single bean for type interface org.springframework.security.authentication.AuthenticationManager, but found []
      at org.springframework.util.Assert.isTrue(Assert.java:65)
      at org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.lazyBean(GlobalMethodSecurityConfiguration.java:377)
      at org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.authenticationManager(GlobalMethodSecurityConfiguration.java:262)
      at org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.methodSecurityInterceptor(GlobalMethodSecurityConfiguration.java:123)
      at org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration$$EnhancerByCGLIB$$8215642a.CGLIB$methodSecurityInterceptor$10(&lt;generated&gt;)
      at org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration$$EnhancerByCGLIB$$8215642a$$FastClassByCGLIB$$8ae0c10a.invoke(&lt;generated&gt;)
      at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
      at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:286)
      at org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration$$EnhancerByCGLIB$$8215642a.methodSecurityInterceptor(&lt;generated&gt;)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:160)
      ... 80 more
  </code></pre>
  
  <p>I've been looking at this for a two days now but can't find a solution for this issue.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Root config:</p>
  
  <pre class="lang-java prettyprint-override"><code>@Configuration
  @ComponentScan(basePackages = "sample.service")
  @Import({SecurityConfig.class, MvcConfiguration.class, RepositoryConfig.class})
  public class RootConfig {
      @Bean
      public PropertyPlaceholderConfigurer getPropertyPlaceholderConfigurer() {
          PropertyPlaceholderConfigurer ppc = new PropertyPlaceholderConfigurer();
          ppc.setLocation(new ClassPathResource("db.properties"));
          ppc.setIgnoreUnresolvablePlaceholders(true);
          return ppc;
      }
  }
  </code></pre>
  
  <p>Web application Initializer:</p>
  
  <pre class="lang-java prettyprint-override"><code>public class WebAppInitializer implements WebApplicationInitializer {
      private static final String DISPATCHER_SERVLET_NAME = "dispatcher";
      private static final String DISPATCHER_SERVLET_MAPPING = "/";
  
      @Override
      public void onStartup(ServletContext servletContext) throws ServletException {
          AnnotationConfigWebApplicationContext rootContext = new AnnotationConfigWebApplicationContext();
          rootContext.register(RootConfig.class);
  
          ServletRegistration.Dynamic dispatcher = servletContext.addServlet(DISPATCHER_SERVLET_NAME, new DispatcherServlet(rootContext));
          dispatcher.setLoadOnStartup(1);
          dispatcher.addMapping(DISPATCHER_SERVLET_MAPPING);
  
          EnumSet&lt;DispatcherType&gt; dispatcherTypes = EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD);
  
          CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter();
          characterEncodingFilter.setEncoding("UTF-8");
          characterEncodingFilter.setForceEncoding(true);
  
          FilterRegistration.Dynamic characterEncoding = servletContext.addFilter("characterEncoding", characterEncodingFilter);
          characterEncoding.addMappingForUrlPatterns(dispatcherTypes, true, "/*");
  
          FilterRegistration.Dynamic security = servletContext.addFilter("springSecurityFilterChain", new DelegatingFilterProxy());
          security.addMappingForUrlPatterns(dispatcherTypes, true, "/*");
  
          FilterRegistration.Dynamic sessionInView = servletContext.addFilter("sessionInView", new OpenEntityManagerInViewFilter());
          sessionInView.addMappingForUrlPatterns(null, true, "/*");
  
          servletContext.addListener(new ContextLoaderListener(rootContext));
      }
  }
  </code></pre>