Take the 2-minute tour ×

I have quite a nut to crack here.. Been trying to integrate said 3 technologies into our webapp.. We want to use

  1. Spring Web
  2. Spring MVC as view technology (with freemarker)
  3. Spring Security as security layer

But whichever way I configure my web.xml and other context files I can't get everything to work at the same time.. With my current configuration everything will work, except SpringSecurity will not intercept the URL patterns

Some googling (and commons sense) told me that combining DispatcherServlet and ContextLoaderListener might be a problem.

So here are my configurations. (Sorry for so much text and thanks for reading):


<!-- Needed by Spring -->


<!-- Needed by Spring MVC -->


<!-- Needed by Spring Security -->

My servlet-context.xml:

<!-- Scan for controllers -->
<context:component-scan base-package="dw.manager" />

<!-- Need to declare annotation driven transactions again so they are picked up above controller methods -->

<mvc:annotation-driven />

    <!-- ... -->

<bean id="freemarkerConfig"
    <!-- ... -->

My manager-context.xml:

<context:annotation-config />   

    <!-- deployment-setup just loads properties (files) -->
<import resource="deployment-setup.xml" />
<import resource="spring-security-context.xml" />
<import resource="dw-manager-datasource.xml" />

<!-- Import sub-modules -->
<import resource="classpath:dw-security-context.xml" />
<!-- ... -->

Spring-Security-context.xml :

<http pattern="/login" security="none" />
<http pattern="/accessDenied" security="none" />
<http pattern="/" security="none" />

<!-- enable use of expressions, define URL patterns and login/logout forms 
    and targets) -->
    <!-- more stuff -->

<!-- a lot more... -->

manager-datasource just sets up the database...

Thank's for reading it all and hopefully helping me.. ;)

edit: some more info

I can't just skip the ContextLoaderListener, it is required by SpringSecurity. I also cannot skip the contextConfigLocation as this is the context required by the ContextLoaderListener. I just define the name myself else it will search for an applicationContext.xml. Maybe I can add an empty contextConfigLocation? But that probably just means, that underlying modules won't find their beans to inject..?


I think the main problem is that SpringSecurity needs a webapp context (ContextLoaderListener) to work but the web application is running inside the servlet context. The controller methods get mapped by the servlet context and thus spring security running "outside" the servlet context doesn't get notified by the event and the filter doesn't kick in..

share|improve this question
Can you tell me what happens if you give a request ilike /test, is it going to the controller or getting redirected to the login page? –  Arun P Johny Jun 11 '12 at 13:29
2012-06-11 15:31:23 PageNotFound [WARN] No mapping found for HTTP request with URI [/dw-manager/test] in DispatcherServlet with name 'appServlet' –  Pete Jun 11 '12 at 13:32
If you give a valid url what is the returned response? –  Arun P Johny Jun 11 '12 at 13:34
If I enter /login it will go to the controller method that maps "/login" and then return the login page. But "/home" is an existing page that should be protected by SpringSecurity (<intercept-url pattern="/*"). It also has a @PreAuthorize annotation that gets ignored... Spring security doesn't even complain that is has no security context as usual if i forget something.. –  Pete Jun 11 '12 at 13:38
I think for PreAutherize to work you need to enable <global-method-security> –  Arun P Johny Jun 11 '12 at 13:46

1 Answer 1

up vote 0 down vote accepted

Sigh.. I don't know why it didn't work the first time around, probably the wrong solution was in the cache while trying the correct one.. However it's working now just the way I posted it. Thank's Arun for your time.

Only problem now: spring-test-mvc does not support Spring Security's FilterChain but that's another question..

share|improve this answer

Your Answer


