title: Using DB authentication and SAML authentication with Spring Security
body: <p>I have an application that is used by two sets of users-internal users for the the company and external customers. My application will communicate either DB and LDAP or DB and SAML. The users can be differentiated based on the username stored in database.</p>
  
  <p>I have to perform authentication based on configuration set. I am succeeded with DB and LDAP, But i am not able to run application with DB and SAML. The application is to be built using Spring Security 3.1.x. </p>
  
  <p>application-context.xml</p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="/login" access="isAuthenticated()" /&gt;
      &lt;form-login login-page="/index" default-target-url="/login"
                  authentication-failure-handler-ref="customAuthenticationFailureHandler"
                  authentication-success-handler-ref="customAuthenticationSuccessHandler"/&gt;
      &lt;logout invalidate-session="true" logout-url="/logout"/&gt;
      &lt;session-management invalid-session-url="/welcome"&gt;&lt;/session-management&gt; 
  &lt;/http&gt;
  </code></pre>
  
  <p>application-database.xml</p>
  
  <pre><code>&lt;beans:bean id="jdbcDaoImplService"
              class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl"&gt;
      &lt;beans:property name="usersByUsernameQuery" value="SELECT USER_ID, USER_PASSWORD,'true' enabled FROM USERS WHERE EXTERNAL_USER='D' AND USER_ID=?"/&gt; 
      &lt;beans:property name="authoritiesByUsernameQuery" value="select u.user_id, r.ROLE_NAME ROLE_NAME from USERS u, USER_ASSIGNED_ROLES ua, SECURITY_ROLES r
                                  where u.user_id = ua.user_id
                                  and ua.role_id = r.role_id
                                  and r.ROLE_ID in(select ROLE_ID from USER_ASSIGNED_ROLES where USER_ID=?)"/&gt; 
      &lt;beans:property name="dataSource" ref="myDataSource" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="jdbcProvider" class="com.configurations.helper.CustomDBAuthenticationProvider"&gt;
      &lt;beans:constructor-arg ref = "jdbcDaoImplService"/&gt;
      &lt;beans:property name="passwordEncoder" ref="passwordEncoder" /&gt;       
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p>application-saml.xml</p>
  
  <pre><code>&lt;security:http pattern="/saml/web/**" use-expressions="false"&gt;
      &lt;security:access-denied-handler error-page="/saml/web/metadata/login"/&gt;
      &lt;security:form-login login-processing-url="/saml/web/login" login-page="/saml/web/metadata/login" default-target-url="/saml/web/metadata"/&gt;
      &lt;security:intercept-url pattern="/saml/web/metadata/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;security:intercept-url pattern="/saml/web/**" access="ROLE_ADMIN"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
  &lt;/security:http&gt;
  
  &lt;security:http entry-point-ref="samlEntryPoint" use-expressions="false"&gt;
      &lt;security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
      &lt;security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
  &lt;/security:http&gt;
  
  &lt;bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>authentication-providers.xml</p>
  
  <pre><code>&lt;authentication-manager alias="authenticationManager"&gt;
      &lt;authentication-provider ref="jdbcProvider" /&gt;
      &lt;authentication-provider ref="samlAuthenticationProvider" /&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>With above configuration i am getting Filter already configured exception.</p>
  
  <p>Below is the exception after starting application:</p>
  
  <pre><code>org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChainProxy': 
  Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: 
  A universal match pattern ('/**') is defined  before other patterns in the filter chain, causing them to be ignored. 
  Please check the ordering in your &lt;security:http&gt; namespace or FilterChainProxy bean configuration
  </code></pre>