title: JavaConfiguration for Spring 4.0 + Security 3.2 + j_spring_security_check
body: <ol>
  <li><p>Create a login page</p>
  
  <pre><code>&lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta charset="ISO-8859-1"&gt;
          &lt;title&gt;Test&lt;/title&gt;
          &lt;script src="static/js/jquery-1.10.2.min.js"&gt;&lt;/script&gt;
          &lt;script src="static/js/app-controller.js"&gt;&lt;/script&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;div&gt;Login&lt;/div&gt;
          &lt;form name="f" action="&lt;c:url value="/j_spring_security_check"/&gt;" method="POST"&gt;
              &lt;label for="password"&gt;Username&lt;/label&gt;&amp;nbsp;&lt;input type="text" id="j_username" name="j_username"&gt;&lt;br/&gt;
              &lt;label for="password"&gt;Password&lt;/label&gt;&amp;nbsp;&lt;input type="password" id="j_password" name="j_password"&gt;&lt;br/&gt;
              &lt;input type="submit" value="Validate"&gt;&amp;nbsp;&lt;input name="reset" type="reset"&gt;
              &lt;input type="hidden" id="${_csrf.parameterName}" name="${_csrf.parameterName}" value="${_csrf.token}"/&gt;
          &lt;/form&gt;
          &lt;hr/&gt;
          &lt;c:if test="${param.error != null}"&gt;
              &lt;div&gt;
                  Failed to login.
                  &lt;c:if test="${SPRING_SECURITY_LAST_EXCEPTION != null}"&gt;
                    Reason: &lt;c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" /&gt;
                  &lt;/c:if&gt;
              &lt;/div&gt;
          &lt;/c:if&gt;
          &lt;hr/&gt;
          &lt;input type="button" value="Echo" id="echo" name="echo" onclick="AppController.echo();"&gt;
          &lt;div id="echoContainer"&gt;&lt;/div&gt;
  
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre></li>
  <li><p>Declare a WebSecurityConfigurer <strong>HERE IS WHERE I WAS MISSING j_username AND j_password</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @ComponentScan(basePackages = {"com.sample.init.security"})
  public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
  
      @Inject
      private AuthenticationProvider authenticationProvider;
  
      @Inject
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(authenticationProvider);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers(
                          "/resources/**", 
                          "/static/**", 
                          "/j_spring_security_check", 
                          "/AppController/echo.html").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .usernameParameter("j_username") /* BY DEFAULT IS username!!! */
                  .passwordParameter("j_password") /* BY DEFAULT IS password!!! */
                  .loginProcessingUrl("/j_spring_security_check")
                  .loginPage("/")
                  .defaultSuccessUrl("/page")
                  .permitAll()
                  .and()
              .logout()
                  .permitAll();
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web
              .ignoring()
                  .antMatchers("/static/**");
      }
  
  }
  </code></pre></li>
  <li><p>Declare a WebMvcConfigurer</p>
  
  <pre><code>@EnableWebMvc
  @Configuration
  @ComponentScan(basePackages = {
          "com.app.controller",        
          "com.app.service",
          "com.app.dao"
  })
  public class WebMvcConfigurer extends WebMvcConfigurerAdapter {
  
      @Bean
      public ViewResolver viewResolver() {
          InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();
          viewResolver.setPrefix("/WEB-INF/view/");
          viewResolver.setSuffix(".jsp");
          return viewResolver;
      }
  
      @Override
      public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/page").setViewName("page");
      }
  
      @Override
      public void addResourceHandlers(ResourceHandlerRegistry registry) {
          registry.addResourceHandler("static/**").addResourceLocations("static/");
      }
  
  }
  </code></pre></li>
  <li><p>Declare a Security Initializer</p>
  
  <pre><code>public class SecurityWebAppInitializer 
      extends AbstractSecurityWebApplicationInitializer { }
  </code></pre></li>
  <li><p>Declare an App Initialzer</p>
  
  <pre><code>public class Initializer extends AbstractAnnotationConfigDispatcherServletInitializer  {
  
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {       
          return new Class&lt;?&gt;[]{WebSecurityConfigurer.class};
      }
  
      @Override
      protected Class&lt;?&gt;[] getServletConfigClasses() {
          return new Class&lt;?&gt;[]{WebMvcConfigurer.class, DataSourceConfigurer.class};
      }
  
      @Override
      protected String[] getServletMappings() {
          return new String[]{"/"};
      }
  
  }
  </code></pre></li>
  <li><p>Implement your custom Authentication Provider</p>
  
  <pre><code>@Component
  @ComponentScan(basePackages = {"com.app.service"})
  public class CustomAuthenticationProvider implements AuthenticationProvider {
  
      private static final Logger LOG = LoggerFactory.getLogger(CustomAuthenticationProvider.class);
  
      @Inject
      private AppService service;
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  
          //Thread.dumpStack();
          String username = authentication.getName();
          String password = authentication.getCredentials().toString();
  
          String message = String.format("Username: '%s' Password: '%s'", username, password);
          UserBean userBean = service.validate(username, password);       
          LOG.debug(message);
          if (userBean != null) {
              List&lt;GrantedAuthority&gt; grantedAuths = new ArrayList&lt;&gt;();
              grantedAuths.add(new SimpleGrantedAuthority("USER"));
              return new UsernamePasswordAuthenticationToken(userBean, authentication, grantedAuths); 
          } else {
              String error = String.format("Invalid credentials [%s]", message);
              throw new BadCredentialsException(error);
          }
      }
  
      @Override
      public boolean supports(Class&lt;?&gt; authentication) {
          return authentication.equals(UsernamePasswordAuthenticationToken.class);
      }
  
  }
  </code></pre></li>
  </ol>
  
  <p>I am skipping EchoController, AppService, AppDao and UserBean.</p>
  
  <p>Thanks.</p>