title: how to define the secured URLs within an application dynamically
body: <p>I am using Spring framework version: 3.2.3.RELEASE and
  Spring security version: 3.2.3.RELEASE</p>
  
  <p>I want to define the secured URLs within an application dynamically,and I have tried for several ways . I just can't make it,please help me!</p>
  
  <p>According to <a href="http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/faq.html#faq-dynamic-url-metadata" rel="nofollow">http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/faq.html#faq-dynamic-url-metadata</a> ,
  I learn that dynamically defining access control to URLs needs using an explicitly declared security filter chain in order to customize the FilterSecurityInterceptor bean.
  My question is</p>
  
  <ol>
  <li>how to explicitly declared security filter chain？are there any example?</li>
  <li>according to the book <a href="http://www.packtpub.com/spring-security-3-1/book" rel="nofollow">Spring security 3.1</a>
  which said"We can use a custom <code>BeanPostProcessor</code> to replace the standard       <code>FilterInvocationServiceSecurityMetadataSource</code> with our custom  implementation."</li>
  </ol>
  
  <p>I followed this way and it dosen't work, I wondering if I have done something wrong?</p>
  
  <p>the Java config class looks like this:</p>
  
  <pre><code> public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
      }
  
  @Configuration
  @EnableWebSecurity
  public class MultiHttpSecurityConfig {
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
          auth
              .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER").and()
                  .withUser("admin").password("password").roles("USER", "ADMIN");
      }
  
      @Configuration
      @Order(1)                                                        
      public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .antMatcher("/api/**")                               
                  .authorizeRequests()
                      .anyRequest().hasRole("ADMIN")
                      .and()
                  .httpBasic();
          }
      }
  
  
      @Configuration                                                   
      public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .authorizeRequests()
                      .anyRequest().authenticated()
                      .and()
                  .formLogin();
          }
      }
  }
  
  @Component
  public class KpiFilterInvocationSecurityMetadataSourceBeanPostProcessor implements BeanPostProcessor {
      @Autowired
      private KpiFilterInvocationSecurityMetadataSource metadataSource;
  
      @Override
      public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
          if(bean instanceof FilterInvocationSecurityMetadataSource) {
              return metadataSource;
          }
          if(bean instanceof FilterChainProxy.FilterChainValidator) {
              return new FilterChainProxy.FilterChainValidator() {
                  @Override
                  public void validate(FilterChainProxy filterChainProxy) {
  
                  }
              };
          }
          return bean;
      }
  
      @Override
      public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
          return bean;
      }
  }
  </code></pre>
  
  <p>I found a method <code>withObjectPostProcessor</code>,and try to do the following,it still doesn't worked. so what is best way to leverage this method? </p>
  
  <pre><code>@Configuration
  public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private KpiFilterInvocationSecurityMetadataSource metadataSource;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf()
                  .disable()
                  .authorizeRequests()
                      .antMatchers("/signup/**", "/about", "/login/**", "/index")
                      .permitAll()
                  .anyRequest()
                      .authenticated()
                  .and()
                      .formLogin()
                      .permitAll()
                      .loginPage("/login/form")
                      .loginProcessingUrl("/login")
                      .usernameParameter("policeNo")
                      .passwordParameter("password")
                      .failureUrl("/login/form?error")
                      .defaultSuccessUrl("/default")
                  .and()
                      .logout()
                      .logoutUrl("/logout")
                      .logoutSuccessUrl("/login/form?logout")
                  .and()
                      .authorizeRequests()
                      .anyRequest()
                      .authenticated()
                      .withObjectPostProcessor(
                          new ObjectPostProcessor&lt;FilterSecurityInterceptor&gt;() {
                                  public &lt;O extends FilterSecurityInterceptor&gt; O postProcess(
                                          O fsi) {
                                      fsi.setSecurityMetadataSource(metadataSource);
                                      return fsi;
                                  }
                              });
          }
  
          @Override
          public void configure(WebSecurity webSecurity) throws Exception {
              webSecurity.ignoring().antMatchers("/resources/**");
          }
      }
  </code></pre>