Spring Security警告：如何修复AuthenticationProvider与UserDetailsService配置冲突？

问题现象 #

启动配置Spring Security的Spring Boot应用时，出现如下警告：

WARN [  restartedMain] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with an AuthenticationProvider bean. UserDetailsService beans will not be used for username/password login. Consider removing the AuthenticationProvider bean. Alternatively, consider using the UserDetailsService in a manually instantiated DaoAuthenticationProvider.

应用配置了JWT认证，相关代码如下：

SecurityFilterChain配置 #

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .csrf(AbstractHttpConfigurer::disable)
            .authorizeHttpRequests(authorize ->
                    authorize
                            .requestMatchers("/assets/**", "/css/**", "/images/**", "/js/**").permitAll()
                            .requestMatchers("/", "/about", "/contact").permitAll()
                            .requestMatchers("/auth/**").permitAll()
                            .anyRequest().authenticated()
            )
            .sessionManagement(session -> session.sessionCreationPolicy(STATELESS))
            .authenticationProvider(authenticationProvider)
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

    return http.build();
}

ApplicationBeanConfiguration配置 #

@Configuration
public class ApplicationBeanConfiguration {

    private final UserRepository userRepository;

    public ApplicationBeanConfiguration(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Bean
    public UserDetailsService userDetailsService() {
        return username -> userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();

        authProvider.setUserDetailsService(userDetailsService());
        authProvider.setPasswordEncoder(passwordEncoder());

        return authProvider;
    }
}

无论是否保留AuthenticationProvider Bean，警告都会持续出现，提示两者配置存在冲突，可能影响用户名/密码认证。

解决方案 #

警告根源是Spring Security自动配置逻辑：容器中同时存在UserDetailsService和AuthenticationProvider Bean时，自动配置会尝试初始化全局AuthenticationManager，但发现已有自定义AuthenticationProvider，便会提示UserDetailsService不会被默认用户名/密码登录流程使用。

方案1：移除独立的UserDetailsService Bean，整合到AuthenticationProvider中 #

既然已经在自定义DaoAuthenticationProvider里设置了UserDetailsService，可以直接将UserDetailsService逻辑内联到AuthenticationProvider配置中，不再单独声明该Bean：

修改ApplicationBeanConfiguration：

@Configuration
public class ApplicationBeanConfiguration {

    private final UserRepository userRepository;

    public ApplicationBeanConfiguration(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        // 直接在这里定义UserDetailsService逻辑，不单独声明Bean
        authProvider.setUserDetailsService(username -> userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found")));
        authProvider.setPasswordEncoder(passwordEncoder());

        return authProvider;
    }
}

容器中仅保留AuthenticationProvider Bean，不会触发自动配置的冲突检查，警告自然消失。

方案2：禁用引发警告的自动配置类 #

如果需要保留UserDetailsService Bean（比如其他业务逻辑需要调用），可以直接禁用InitializeUserDetailsManagerConfigurer自动配置：

在主启动类或配置类上添加注解：

@SpringBootApplication(exclude = {InitializeUserDetailsManagerConfigurer.class})

或者在application.properties中添加：

spring.autoconfigure.exclude=org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsManagerConfigurer

该方式阻止自动配置类加载，避免冲突检查逻辑，从而消除警告。

验证 #

修改配置后重启应用，警告信息应不再出现。同时检查JWT认证及用户名/密码认证（若有）的功能是否正常，确保配置变更未影响原有业务。

内容的提问来源于stack exchange，提问作者Hyusein Lesho