ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken

Q: Expose AuthenticationManager via HttpSecurity

When to use: Use this when building a custom login controller in Spring Security 6.. In Spring Security 6, you must explicitly build the AuthenticationManager from the HttpSecurity shared object to ensure default providers are wired up.

Q: Define a DaoAuthenticationProvider Bean

When to use: Use this if you prefer explicit bean configuration over HttpSecurity builders.. Manually create the provider that handles username/password authentication and expose it as a bean.

Q: Use Spring Boot Default Form Login

When to use: Use this if you don't need a custom JSON login API.. If you configure `http.formLogin()`, Spring Boot auto-configures the DaoAuthenticationProvider for you.

Q: Ensure UserDetailsService bean exists

When to use: Use this if you configured the provider but it still fails.. The DaoAuthenticationProvider needs a UserDetailsService to fetch users from the DB. If it's missing, the provider cannot be initialized.

Q: Check for profile mismatches

When to use: Use this if your config works locally but fails in prod.. Ensure your SecurityConfig class is not annotated with `@Profile("dev")` if you are running in production, as the bean won't be created.

🔴 The Error You're Seeing

Confirm this matches your console output. If it does, you're in the right place.

ERROR LOG

org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:202)
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:183)

⚡ Quick Fix Works 80% of the time

Expose an AuthenticationManager bean and ensure a DaoAuthenticationProvider is configured.

@Bean
public AuthenticationManager authManager(HttpSecurity http, UserDetailsService uds, PasswordEncoder encoder) throws Exception {
    AuthenticationManagerBuilder builder = http.getSharedObject(AuthenticationManagerBuilder.class);
    builder.userDetailsService(uds).passwordEncoder(encoder);
    return builder.build();
}

🧠 Why this Happens

Tap to expand the deep technical explanation

You created a custom login endpoint (e.g., `/api/login`) and injected an `AuthenticationManager` to verify the credentials. However, Spring Security's ProviderManager iterated through its registered `AuthenticationProvider`s and couldn't find one that supports `UsernamePasswordAuthenticationToken`. This happens if you built a custom SecurityFilterChain but forgot to register a `DaoAuthenticationProvider`.

The HITEC City Parking Spot Analogy:

Imagine showing up at an airport check-in desk with a train ticket. The desk attendant (ProviderManager) looks at all the systems they have available (airlines) and says, 'I don't have any system that can process a train ticket.'

🔁 How to Reproduce Confirm this is your error

Create a custom SecurityFilterChain. Do not configure any form login or AuthenticationProvider. Inject `AuthenticationManager` into a controller and call `authManager.authenticate(new UsernamePasswordAuthenticationToken(...))`.

🛠️ Solutions (5 Ways to Fix)

Solution 1✓ Most common cause

Expose AuthenticationManager via HttpSecurity

👉 Use this when building a custom login controller in Spring Security 6.

In Spring Security 6, you must explicitly build the AuthenticationManager from the HttpSecurity shared object to ensure default providers are wired up.

@Bean
public AuthenticationManager authManager(HttpSecurity http, UserDetailsService uds, PasswordEncoder encoder) throws Exception {
    AuthenticationManagerBuilder builder = http.getSharedObject(AuthenticationManagerBuilder.class);
    builder.userDetailsService(uds).passwordEncoder(encoder);
    return builder.build();
}

Solution 2

Define a DaoAuthenticationProvider Bean

👉 Use this if you prefer explicit bean configuration over HttpSecurity builders.

Manually create the provider that handles username/password authentication and expose it as a bean.

@Bean
public AuthenticationProvider authProvider(UserDetailsService uds, PasswordEncoder encoder) {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setUserDetailsService(uds);
    provider.setPasswordEncoder(encoder);
    return provider;
}

Solution 3

Use Spring Boot Default Form Login

👉 Use this if you don't need a custom JSON login API.

If you configure `http.formLogin()`, Spring Boot auto-configures the DaoAuthenticationProvider for you.

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
        .formLogin(form -> form.permitAll());
    return http.build();
}

Solution 4

Ensure UserDetailsService bean exists

👉 Use this if you configured the provider but it still fails.

The DaoAuthenticationProvider needs a UserDetailsService to fetch users from the DB. If it's missing, the provider cannot be initialized.

@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) { ... }
}

Solution 5

Check for profile mismatches

👉 Use this if your config works locally but fails in prod.

Ensure your SecurityConfig class is not annotated with `@Profile("dev")` if you are running in production, as the bean won't be created.

// Remove @Profile("dev") if this config is needed globally
@Configuration
public class SecurityConfig { ... }

📋 Version Notes

Spring Boot 2.x

WebSecurityConfigurerAdapter auto-configured the AuthenticationManager.

Spring Boot 3.x

Adapter removed. AuthenticationManager must be explicitly exposed as a Bean.

🛡️ How to Prevent This Next Time

When building custom login endpoints, always map out the Authentication flow: Controller -> AuthenticationManager -> AuthenticationProvider -> UserDetailsService.