title: spring security jdbc throws null pointer
body: <p>I am trying to use Spring-Security 4.0.0.M1 with Spring-Boot 1.0.2.RELEASE with H2 and Spring-data-jpa.1.5.2.  I am able to create a user in the SecurityConfig.configure method, but when I extract this out to its own class, I get a nullpointer exception.  I step into JdbcDaoSupport.java and see that the getJdbcTemplate() returns a null jdbcTemplate.</p>
  
  <p>Here is my config:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = false)
  public class SecurityConfig extends WebSecurityConfigurerAdapter { 
      @Autowired
      private DataSource dataSource;
  
      @Autowired
      UserService userService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
                  .authorizeRequests()
                  .antMatchers( "/resources/**" ).permitAll()
                  .antMatchers( "/css/**" ).permitAll();
  
          http
                  .formLogin().failureUrl( "/login?error" )
                  .defaultSuccessUrl( "/" )
                  .loginPage( "/login" )
                  .permitAll()
                  .and()
                  .logout().logoutRequestMatcher( new AntPathRequestMatcher( "/logout" ) ).logoutSuccessUrl( "/login" )
                  .permitAll();
  
          http
                  .authorizeRequests().anyRequest().authenticated();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .jdbcAuthentication()
                  .dataSource( dataSource );
      }
  
      @Bean
      @Override
      public AuthenticationManager authenticationManager() throws Exception {
          return super.authenticationManagerBean();
      }
  }
  </code></pre>
  
  <p>My main configuration class has the datasource defined, which I know to work:</p>
  
  <pre><code>@Bean
  public DataSource dataSource() {
      return new EmbeddedDatabaseBuilder().setType( EmbeddedDatabaseType.H2 ).setName( "ofac" )
              .addScript( "classpath:h2.sql" ).build();
  }
  </code></pre>
  
  <p>I have a User Service for adding users as such:</p>
  
  <pre><code>@Component
  public class UserService {
  
      @Autowired
      private AuthenticationManagerBuilder authenticationManagerBuilder;
  
      @Autowired
      private javax.sql.DataSource dataSource;
  
      @PostConstruct()
      public void initUsers() throws Exception {
          addNewUser( "admin", "password", "ADMIN" );
      }
  
       public void addNewUser(String username, String plainPassword, String role) {
  
      List&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
      authorities.add( new SimpleGrantedAuthority( role ) );
      PasswordEncoder encoder = new BCryptPasswordEncoder();
  
      UserDetails hashedUser = new User( username, encoder.encode( plainPassword ), authorities );
  
      JdbcUserDetailsManager userDetailsService = (JdbcUserDetailsManager) authenticationManagerBuilder.getDefaultUserDetailsService();
      try {
          if ( userDetailsService.userExists( hashedUser.getUsername() ) ) {
              userDetailsService.deleteUser( hashedUser.getUsername() );
          }
          // and finally, create the user
          userDetailsService.createUser( hashedUser );
      } catch ( Exception ex ) {
          ex.printStackTrace();
      }
   }
  }
  </code></pre>
  
  <p>I have a breakpoint on the UserService.initUsers and when the line:</p>
  
  <pre><code>authenticationManagerBuilder.jdbcAuthentication().getUserDetailsService().userExists( hashedUser.getUsername() ) 
  </code></pre>
  
  <p>is invoked, I can see that <code>authenticationManagerBuilder.jdbcAuthentication()</code> returns a null jdbcTemplate.  All the online documentation seems to indicate this would work, but it does not seem to wire up everything as I am expecting.</p>
  
  <p>Does anyone know what might be wrong?</p>
  
  <p><strong>UPDATE</strong>:
  I changed the project so I no longer have the SecurityConfig, but instead to have a:</p>
  
  <pre><code>@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  @Configuration
  public class ApplicationSecurity extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .authorizeRequests()
                  .antMatchers( "/resources/**" ).permitAll()
                  .antMatchers( "/css/**" ).permitAll();
  
          http
                  .formLogin().failureUrl( "/login?error" )
                  .defaultSuccessUrl( "/" )
                  .loginPage( "/login" )
                  .permitAll()
                  .and()
                  .logout().logoutRequestMatcher( new AntPathRequestMatcher( "/logout" ) ).logoutSuccessUrl( "/login" )
                  .permitAll();
  
          http
                  .authorizeRequests().anyRequest().authenticated();
      }
  }
  </code></pre>
  
  <p>and a: </p>
  
  <pre><code>@Order(Ordered.HIGHEST_PRECEDENCE)
  @Configuration
  public class AuthenticationSecurity extends GlobalAuthenticationConfigurerAdapter {
  
  
      @Autowired
      private DataSource dataSource;
  
      @Override
      public void init(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .jdbcAuthentication()
                  .dataSource( dataSource );
      }
  }
  </code></pre>
  
  <p>But in my UserService, I get a null userDetailsService here:</p>
  
  <pre><code>JdbcUserDetailsManager userDetailsService = (JdbcUserDetailsManager) authenticationManagerBuilder.getDefaultUserDetailsService();
  </code></pre>
  
  <p>I have not figured out how to actually create a user after startup.  I thought it was with a UserDetailsService, but that doesn't provide the functionality. I thought maybe a JdbcUserDetailsManager is needed, but so far I haven't been able to wire one up that works.</p>