title: Spring security unsupported configuration attributes
body: <p>I have the following snippet</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;http use-expressions="true" auto-config="false"
          entry-point-ref="loginUrlAuthenticationEntryPoint"
          access-decision-manager-ref="accessDecisionManager" disable-url-rewriting="false"&gt;
          &lt;!--&lt;custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter"
              /&gt; --&gt;
          &lt;custom-filter position="FORM_LOGIN_FILTER"
              ref="usernamePasswordAuthenticationFilter" /&gt;
          &lt;custom-filter position="LOGOUT_FILTER" ref="tapLockFilter" /&gt;
  
          &lt;intercept-url pattern="/session/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/deviceregistration/**" access="permitAll" /&gt;
          &lt;intercept-url pattern="/session/lock" access="hasRole('ROLE_MEMBER')" /&gt;
          &lt;intercept-url pattern="/app/resources/admin*" access="hasRole('ROLE_ADMIN')" /&gt;
          &lt;intercept-url pattern="/app/SuperAppdashboard*" access="hasRole('ROLE_ADMIN')" /&gt;
          &lt;intercept-url pattern="/app/*" access="hasRole('ROLE_MEMBER')" /&gt;
  
  
          &lt;!--&lt;session-management invalid-session-url="/tizelytics/session/invalidSession"
              session-authentication-error-url="/tizelytics/session/accessDenied" session-authentication-strategy-ref="sas"&gt;
              &lt;/session-management&gt; --&gt;
  
          &lt;session-management invalid-session-url="/session/invalidSession"
              session-authentication-error-url="/session/accessDenied"
              session-fixation-protection="none"&gt;
              &lt;concurrency-control max-sessions="1"
                  expired-url="/session/accessExpired" /&gt;
          &lt;/session-management&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>When i run this on server it throws an exception saying</p>
  
  <blockquote>
    <p>Unsupported configuration attributes: [permitAll, permitAll, hasRole('ROLE_ADMIN'), hasRole('ROLE_ADMIN'), hasRole('ROLE_MEMBER'), hasRole('ROLE_MEMBER')]</p>
  </blockquote>
  
  <p>here is my access-decision-manager bean within the same xml</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;beans:bean id="accessDecisionManager"
          class="org.springframework.security.access.vote.AffirmativeBased"&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:list&gt;
                  &lt;beans:bean
                      class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
                  &lt;beans:bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;/beans:list&gt;
          &lt;/beans:constructor-arg&gt;
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p><strong>If i remove the access-decision-manager-ref</strong> no exception is thrown the app launches correctly can anyone please advice?</p>