Hi, @paschm. Can you verify if making your bean method static solves the problem? Another alternative is to declare it as a infrastructural bean as mentioned in this comment.

Hello @marcusdacoregio,

thanks for your advice.

Can you verify if making your bean method static solves the problem?

@Configuration
@EnableMethodSecurity(
        jsr250Enabled = true
)
public class SecurityConfig {

    @Bean
    public static GrantedAuthorityDefaults grantedAuthorityDefaults() {
        return new GrantedAuthorityDefaults("");    // Remove the ROLE_ prefix
    }
}

still leads to

2024-03-15T09:08:34.319+01:00 WARN 17856 --- [ main] trationDelegate$BeanPostProcessorChecker : Bean 'grantedAuthorityDefaults' of type [org.springframework.security.config.core.GrantedAuthorityDefaults] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying). Is this bean getting eagerly injected into a currently created BeanPostProcessor [healthEndpointGroupsBeanPostProcessor]? Check the corresponding BeanPostProcessor declaration and its dependencies.

Another alternative is to declare it as a infrastructural bean as mentioned in #14209 (comment).

@Configuration
@EnableMethodSecurity(
        jsr250Enabled = true
)
public class SecurityConfig {

    @Bean
    @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
    public GrantedAuthorityDefaults grantedAuthorityDefaults() {
        return new GrantedAuthorityDefaults("");    // Remove the ROLE_ prefix
    }
}

leads to

2024-03-15T08:24:00.647+01:00 WARN 25184 --- [ main] trationDelegate$BeanPostProcessorChecker : Bean 'securityConfig' of type [com.example.demo.SecurityConfig$$SpringCGLIB$$0] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying). Is this bean getting eagerly injected into a currently created BeanPostProcessor [healthEndpointGroupsBeanPostProcessor]? Check the corresponding BeanPostProcessor declaration and its dependencies.

The combination of both ( static + role hint ) does work and the bean seems to be initialized

@Configuration
@EnableMethodSecurity(
        jsr250Enabled = true
)
public class SecurityConfig {

    @Bean
    @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
    public static GrantedAuthorityDefaults grantedAuthorityDefaults() {
        return new GrantedAuthorityDefaults("");    // Remove the ROLE_ prefix
    }
}

Maybe the addition of the role hint should be added to the documentation? https://docs.spring.io/spring-security/reference/servlet/authorization/architecture.html#authz-authorities

Thanks for checking @paschm.

The reason that happens is because the GrantedAuthorityDefaults bean is used very early in the application initialization when configuring the MethodInterceptors for Method Security. I agree with you that it is important to alert users that if they are using @EnableMethodSecurity they should consider adding @Role(BeanDefinition.ROLE_INFRASTRUCTURE) in addition to their bean method being static.

Are you interested in submitting a PR that updates the documentation?

Hello @marcusdacoregio,

Are you interested in submitting a PR that updates the documentation?

I submitted a PR, see above. I didn't extend the xml example, as we don't use xml configuration any more and I don't know how you can do a infrastructure bean declaration in this case. Feel free to extend it yourself, if necessary.

Closed in favor of https://github.com/spring-projects/spring-security/pull/14779/files