title: Spring security - How to configure multiple authentication providers using java config
body: <p>I m trying to configure an application which has multiple authentication mechanisms(DB and LDAP) and which uses spring security as its underlying framework.  I m using java configuration to set up the web and http security.  I understand that we would need multiple WebSecurityConfigurerAdapter instances for multiple http elements(as used in xml based config); but when I do that, the application only picks up the first authentication configured(database auth) and never authenticates with the 2nd authentication(ldap auth). Any reason why ?  Here is the code snippet </p>
  
  <pre><code>@EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  public class SecurityConfiguration{
  
  @Configuration
  @Order(1)
  public static class DBSecurityConfig extends WebSecurityConfigurerAdapter {
  
   @Inject
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .userDetailsService(userDetailsService);
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring()
              .antMatchers("/scripts/**/*.{js,html}")
              .antMatchers("/console*");
      }
  
   protected void configure(HttpSecurity http) throws Exception {
  
          http.csrf()
              .addFilterAfter(new CsrfCookieGeneratorFilter(), CsrfFilter.class)
              .exceptionHandling()
              .authenticationEntryPoint(authenticationEntryPoint)
              .and()
              .formLogin()
              .loginProcessingUrl("/api/authentication")
              .successHandler(ajaxAuthenticationSuccessHandler)
              .failureHandler(ajaxAuthenticationFailureHandler)
              .usernameParameter("j_username")
              .passwordParameter("j_password")
              .permitAll()
              .and()
              .logout()
              .logoutUrl("/api/logout")
              .logoutSuccessHandler(ajaxLogoutSuccessHandler)
              .deleteCookies("JSESSIONID")
              .permitAll()
              .and()
              .headers()
              .frameOptions()
              .disable()
              .and()
              .authorizeRequests()
              .antMatchers("/api/**").permitAll()
              .antMatchers("/api*//**").authenticated();
           }
       }
  
  @Configuration
  public static class LDAPSecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Inject
      public void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.ldapAuthentication()
              .userDnPatterns("uid={0},ou=people")
              .groupSearchBase("ou=groups")
              .contextSource()
              .ldif("classpath:users.ldif");
      }
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring()
              .antMatchers("/console*");
      }
  
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf()
              .addFilterAfter(new CsrfCookieGeneratorFilter(), CsrfFilter.class)
              .exceptionHandling()
              .authenticationEntryPoint(ldapAuthenticationEntryPoint)
              .and()
              .formLogin()
              .loginProcessingUrl("/api/ldapAuthentication")
              .successHandler(ldapAjaxAuthenticationSuccessHandler)
              .failureHandler(ldapAjaxAuthenticationFailureHandler)
              .usernameParameter("j_username")
              .passwordParameter("j_password")
              .permitAll()
              .and()
              .logout()
              .logoutUrl("/api/logout")
              .logoutSuccessHandler(ajaxLogoutSuccessHandler)
              .deleteCookies("JSESSIONID")
              .permitAll()
              .and()
              .headers()
              .frameOptions()
              .disable()
              .and()
              .authorizeRequests()
              .antMatchers("/api/**").permitAll()
              .antMatchers("/api*//**").authenticated();
      }
  }
  </code></pre>
  
  <p>I edited some of the code for brevity.  Any insight as to why it is not picking up the ldap authentication is appreciated.</p>
  
  <p>Thanks</p>