No qualifying bean of type 'org.springframework.security.authentication.AuthenticationManager'

Q: Expose AuthenticationManager via AuthenticationConfiguration

When to use: Use this in Spring Boot 3 / Spring Security 6 when you need to inject it into a custom login controller.. In Spring Security 6, the AuthenticationManager is no longer automatically exposed as a Bean. You must retrieve it from the AuthenticationConfiguration object.

Q: Use HttpSecurity to get the AuthenticationManager

When to use: Use this if you are configuring security inline and want the specific manager for that filter chain.. You can retrieve the shared AuthenticationManager from the HttpSecurity builder during filter chain construction.

Q: Build a custom ProviderManager

When to use: Use this if you want to completely bypass default configuration and define your own authentication logic.. Manually create an AuthenticationManager using DaoAuthenticationProvider and a UserDetailsService.

🔴 The Error You're Seeing

Confirm this matches your console output. If it does, you're in the right place.

ERROR LOG

2026-02-14 08:00:15.000 ERROR 8842 --- [           main] o.s.boot.SpringApplication               : Application run failed

org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type 'org.springframework.security.authentication.AuthenticationManager' available: expected at least 1 bean which qualifies as autowire candidate.

⚡ Quick Fix Works 80% of the time

Expose the AuthenticationManager as a Bean in your SecurityConfig using AuthenticationConfiguration.

@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
    return config.getAuthenticationManager();
}

🛠️ Solutions (3 Ways to Fix)

Solution 1✓ Most common cause

Expose AuthenticationManager via AuthenticationConfiguration

👉 Use this in Spring Boot 3 / Spring Security 6 when you need to inject it into a custom login controller.

In Spring Security 6, the AuthenticationManager is no longer automatically exposed as a Bean. You must retrieve it from the AuthenticationConfiguration object.

@Configuration
public class SecurityConfig {
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }
}

Solution 2

Use HttpSecurity to get the AuthenticationManager

👉 Use this if you are configuring security inline and want the specific manager for that filter chain.

You can retrieve the shared AuthenticationManager from the HttpSecurity builder during filter chain construction.

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    AuthenticationManagerBuilder builder = http.getSharedObject(AuthenticationManagerBuilder.class);
    AuthenticationManager manager = builder.build();
    http.authenticationManager(manager);
    return http.build();
}

Solution 3

Build a custom ProviderManager

👉 Use this if you want to completely bypass default configuration and define your own authentication logic.

Manually create an AuthenticationManager using DaoAuthenticationProvider and a UserDetailsService.

@Bean
public AuthenticationManager authManager(UserDetailsService userDetailsService, PasswordEncoder encoder) {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setUserDetailsService(userDetailsService);
    provider.setPasswordEncoder(encoder);
    return new ProviderManager(provider);
}

📋 Version Notes

Spring Boot 2.x

AuthenticationManager could be injected directly by extending WebSecurityConfigurerAdapter.

Spring Boot 3.x

WebSecurityConfigurerAdapter is removed. AuthenticationManager must be explicitly exposed as a Bean.

🧠 Why this Happens

Tap to expand the deep technical explanation

In Spring Security 6, the framework no longer auto-registers an AuthenticationManager as a Spring Bean to encourage explicit configuration. If you try to @Autowired it into a controller, Spring's application context cannot find it.

The HITEC City Parking Spot Analogy:

It is like looking for a specific tool in a shared toolbox. In the past, the tool was always there by default. Now, you have to explicitly request the factory (AuthenticationConfiguration) to build it and put it in the box before you can use it.

🛡️ How to Prevent This Next Time

When migrating to Spring Boot 3, search for all usages of AuthenticationManager and ensure your SecurityConfig exposes it.