title: Spring Security XML Config Vs Java Config
body: <p>I have XML config for Spring Security, that I've made through tonnes of guides.
  It supposed to intercepts url and with custom filters provide authentication with ldap authentication manager.</p>
  
  <p>So here it is:
      </p>
  
  <pre><code>   &lt;http create-session="stateless" auto-config='false' use-expressions="true"&gt;
      &lt;anonymous enabled="true"/&gt;
      &lt;intercept-url pattern="/index.html" access="permitAll()" method="GET"/&gt;
      &lt;intercept-url pattern="/login" access="permitAll()" method="GET"/&gt;
  
  
      &lt;custom-filter before="LAST" ref="statelessLoginFilter"/&gt;
      &lt;custom-filter before="PRE_AUTH_FILTER" ref="statelessAuthFilter"/&gt;
  
      &lt;intercept-url pattern="/one*" access="hasRole('ROLE_ONE')" method="GET"/&gt;
      &lt;intercept-url pattern="/two*" access="hasRole('ROLE_TWO')" method="GET"/&gt;
  
      &lt;!-- another intercept-url stuff --&gt;
  
      &lt;csrf disabled="true"/&gt;
  
      &lt;!-- authentication manager and stuff --&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>Right now I'm trying to rewrite it with Java Config. But I can't get how to use custom filters in there. There's .addFilterBefore but I can't just put before="LAST" or before="PRE_AUTH_FILTER" there. Because there's no such thing. How can I rewrite this?</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  GenericFilterBean statelessAuthFilter;
  @Autowired
  AbstractAuthenticationProcessingFilter statelessLoginFilter;
  
  public  SecurityConfig(){
  
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
              .authorizeRequests()
              .antMatchers("/one**", "/two**").access("hasRole('ONE')")
              .antMatchers("/login").permitAll()
              .anyRequest().authenticated()
  
              .and()
              .addFilterBefore(statelessAuthFilter, GenericFilterBean.class)
              .addFilterBefore(statelessLoginFilter, BasicAuthenticationFilter.class)
              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
  
              .and().anonymous()
              .and().csrf().disable();
  }}
  </code></pre>