InitializeUserDetailsBeanManagerConfigurer warning names wrong logger (inner class vs. suggested outer class)

Start in config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java, focusing on the logger declaration in the inner class and the warning text. Reproduce the warning with an AuthenticationProvider and UserDetailsService, then verify that configuring the logger name stated in the message suppresses it. Done means the emitted logger name matches the name documented by the warning.

InitializeUserDetailsBeanManagerConfigurer logs this warning (added in #15538) when a global AuthenticationManager is built from an AuthenticationProvider bean while a UserDetailsService bean is also present:

If the current configuration is intentional, to turn off this warning, increase the logging level of 'org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer' to ERROR

Following this instruction does not actually suppress the warning.

The Log that emits the message is created inside the non-static inner class InitializeUserDetailsManagerConfigurer:

https://github.com/spring-projects/spring-security/blob/main/config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java#L65

class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {
    class InitializeUserDetailsManagerConfigurer extends GlobalAuthenticationConfigurerAdapter {
        private final Log logger = LogFactory.getLog(getClass());

getClass() here resolves to the inner class, so the real logger name is:

org.springframework.security.config.annotation.authentication.configuration.InitializeUserDetailsBeanManagerConfigurer$InitializeUserDetailsManagerConfigurer

— not the outer class name the message tells you to configure. Most logging backends (e.g. Log4j2) tokenize logger hierarchy on . only, so $ does not create a parent/child relationship. A logger override for exactly the name in the message therefore has no effect; only overriding the parent package, or the full Outer$Inner name, actually works. This is confusing since the message text never shows a $, so there's no visible hint that the suggested name is wrong.

Same bug class as spring-kafka#714 (fixed there): https://github.com/spring-projects/spring-kafka/issues/714

Suggested fix: create the Log on the outer class and reuse it in the inner class, so the logger name matches what the message says — or update the message to name the actual logger / suggest the parent package instead.

Repro

1. Register a custom AuthenticationProvider bean alongside a UserDetailsService bean.
2. Start the app, observe the warning.
3. Configure the exact logger name from the message to ERROR (e.g. in Log4j2) — warning still appears after restart.
4. Configure org.springframework.security.config.annotation.authentication.configuration (the parent package) to ERROR instead — warning is suppressed.

Version: 7.0.3 (also present on main).