title: creating <intercept-url pattern> dynamically with spring security 3
body: <p>Hi I am new to Spring security 3 but with the help of this site I successfully developed Authentication and Authorization. Now I want to remove intercept-url pattern from my context-security.xml. I am looking to fetch authorities for specific user form database and create  dynamically. Here i did...</p>
  
  <p>in context-security.xml</p>
  
  <pre><code>&lt;beans:bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"&gt;
              &lt;custom-filter before="FIRST" ref="requestMappings"/&gt;
              &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt;
              &lt;beans:property name="accessDecisionManager" ref="accessDecisionManager" /&gt;
              &lt;beans:property name="objectDefinitionSource" ref="requestMappings" /&gt;
          &lt;/beans:bean&gt;
  
          &lt;beans:bean id="requestMappings" class="com.nmmc.common.security.repository.RequestMappingFactoryBean" /&gt;
  
      &lt;http auto-config="true" once-per-request="false"&gt;
  
          &lt;!-- Restrict URLs based on role --&gt;
          &lt;intercept-url pattern="/login.works" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
          &lt;intercept-url pattern="/login/validate.works" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;     
          &lt;intercept-url pattern="/css/*" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt; 
  
          &lt;form-login login-page="/login.works" login-processing-url="/j_spring_security_check"
              default-target-url="/login/validate.works"
              authentication-failure-url="/login.works" /&gt;
          &lt;logout logout-url="/j_spring_security_logout"
              logout-success-url="/login.works" invalidate-session="true" /&gt;
  
          &lt;session-management invalid-session-url="/login.works"
              session-fixation-protection="none"&gt;
              &lt;concurrency-control max-sessions="50"
                  error-if-maximum-exceeded="true" /&gt;
          &lt;/session-management&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider ref="customAuthenticationProvider"&gt;&lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean id="customAuthenticationProvider"
          class="com.nmmc.common.security.repository.CustomAuthenticationProvider"&gt;&lt;/beans:bean&gt;
  </code></pre>
  
  <p>in RequestMappingFactoryBean</p>
  
  <pre><code>import org.springframework.beans.factory.FactoryBean;
  
  public class RequestMappingFactoryBean implements FactoryBean{
      private final static String EOL = System.getProperty("line.separator"); 
      public Object getObject() throws Exception
      {
          StringBuffer sb = new StringBuffer();
          sb.append("CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON");
          sb.append(EOL);
          sb.append("PATTERN_TYPE_APACHE_ANT");
          sb.append(EOL);
          sb.append("/**login.works=IS_AUTHENTICATED_ANONYMOUSLY");
          sb.append(EOL);
          sb.append("/user/**=ROLE_ADMIN");
          return sb.toString();    
      }    
      public Class getObjectType()
      {       
          return String.class;
      }
      public boolean isSingleton()
      {       
          return true;
      }   
  }
  </code></pre>
  
  <p>Also when I remove ref from</p>
  
  <pre><code>&lt;custom-filter before="FIRST" ref="requestMappings"/&gt;
  </code></pre>
  
  <p>then it gives error that ref must be define also if i define it and run my app it gives error like</p>
  
  <pre><code>org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Security namespace does not support decoration of element [custom-filter]
  </code></pre>
  
  <p>thats why i define as given.
  Is there any changes in my code to run it?</p>