Spring Security中ProviderManager无法实例化问题求助

错误根源 #

org.springframework.security.authentication.ProviderManager不存在无参构造函数，当Spring容器尝试通过无参方式实例化它时就会抛出该异常。通常是因为Security配置中错误声明ProviderManager Bean，或是配置AuthenticationManager的方式不符合Spring Security的规范。

修复方案 #

1. 正确配置AuthenticationManager #

不要手动实例化ProviderManager，而是通过AuthenticationConfiguration或AuthenticationManagerBuilder来构建合法的AuthenticationManager实例：

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final MyUserDetailsService userDetailsService;

    public SecurityConfig(MyUserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        // 借助AuthenticationConfiguration获取已正确初始化的AuthenticationManager
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public DaoAuthenticationProvider daoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        // 根据实际密码存储策略设置编码器
        provider.setPasswordEncoder(passwordEncoder());
        return provider;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

2. 避免直接注入ProviderManager #

在Controller或Service中，不要直接注入ProviderManager，而是注入AuthenticationManager接口，Spring会自动提供符合要求的实现实例。

3. 规范自定义认证逻辑 #

如果你的流程需要第三方session校验，要通过自定义AuthenticationProvider实现逻辑，而非手动创建ProviderManager：

@Component
public class ThirdPartySessionAuthProvider implements AuthenticationProvider {

    private final MyApiRestService apiRestService;
    private final MyUserDetailsService userDetailsService;

    public ThirdPartySessionAuthProvider(MyApiRestService apiRestService, MyUserDetailsService userDetailsService) {
        this.apiRestService = apiRestService;
        this.userDetailsService = userDetailsService;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // 处理第三方session校验逻辑
        String sessionId = (String) authentication.getPrincipal();
        String username = apiRestService.getUsernameFromThirdParty(sessionId);
        UserDetails userDetails = userDetailsService.loadUserByUsername(username);
        
        return new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return ThirdPartySessionAuthToken.class.isAssignableFrom(authentication);
    }
}

然后在SecurityConfig中注册该Provider：

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(daoAuthenticationProvider())
        .authenticationProvider(thirdPartySessionAuthProvider());
}

核心注意事项 #

• 始终通过Spring提供的AuthenticationManagerBuilder或AuthenticationConfiguration获取AuthenticationManager，禁止手动实例化ProviderManager。
• 确保所有自定义AuthenticationProvider都被正确注册到AuthenticationManager中。
• 检查代码中是否存在new ProviderManager()的写法，全部替换为Spring管理的Bean实例。

内容的提问来源于stack exchange，提问作者AlanT