InitializeUserDetailsBeanManagerConfigurer does configure a DaoAuthenticationProvider without Encoder although there are encoders found

Hi,

using spring-security 6.3.3 the InitializeUserDetailsBeanManagerConfigurer does have this code:

PasswordEncoder passwordEncoder = getBeanOrNull(PasswordEncoder.class);

It does look for a password encoder and if this one returns null, a new DaoAuthenticationProvider(); is used.

The problem is, that if more than one encoder is in the context, getBeanOrNull(PasswordEncoder.class) does return null too. This is imho unexpected see here

Expected behavior
My expectation would be, that if more than one PasswordEncoder is found, that the context build fails here and issues an error OR tell the user with a WARN message that the first one found is used.

But simple not using any encoder at all, although there are some configured is a problem. The problem was found, because an upstream project used by me configured its own encoder (which is not that easy to discover with component scanning enabled) and I had myself already one configured and wondered, why NO encoder at all was registered on the DaoAuthenticationProvider - a warning or an error would be nice here.

Start in config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/InitializeUserDetailsBeanManagerConfigurer.java, especially the PasswordEncoder lookup around lines 95 and 126. Reproduce the configuration with multiple PasswordEncoder beans and verify that the completed behavior no longer silently creates a DaoAuthenticationProvider without an encoder, with an appropriate regression test.