title: Using multiple WebSecurityConfigurerAdapter in spring boot
body: <p>I'm having 2 classes which extends <code>WebSecurityConfigurerAdapter</code>. And can't make them work together.</p>
  
  <p>The idea is as follows:</p>
  
  <ol>
  <li>Have one <code>WebSecurityConfigurerAdapter</code> which only adds custom filter to security chain. The filter does some custom authentication and saves <code>Authentication</code> into <code>SecurityContext</code>. This generally works fine. Configured as follows (imports omitted):</li>
  </ol>
  
  <pre class="lang-java prettyprint-override"><code> @Order(1)
   @Configuration
   @EnableWebMvcSecurity
   public class BestSecurityConfig extends WebSecurityConfigurerAdapter {
  
       @Autowired
       private BestPreAuthenticationFilter ssoAuthenticationFilter;
  
       @Bean
       protected FilterRegistrationBean getSSOAuthenticationFilter() {
           FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean(ssoAuthenticationFilter);
  
           // Avoid include to the default chain
           filterRegistrationBean.setEnabled(false);
  
           return filterRegistrationBean;
       }
  
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http
              .addFilterAfter(ssoAuthenticationFilter, SecurityContextPersistenceFilter.class);
  
       }
  
       @Configuration
       protected static class AuthenticationConfiguration extends
               GlobalAuthenticationConfigurerAdapter {
  
           @Autowired
           private BestAuthenticationProvider authenticationProvider;
  
           @Override
           public void configure(AuthenticationManagerBuilder auth) throws Exception {
               auth.authenticationProvider(authenticationProvider);
           }
       }
   }
  </code></pre>
  
  <ol start="2">
  <li>I want the above to be kind of library class which anyone can include via <code>@ComponentScan</code> and get the custom authentication sorted. Obviously they want to provide custom <code>HttpSecurity</code> to secure edpoints. Trying something like:</li>
  </ol>
  
  <pre class="lang-java prettyprint-override"><code> @Configuration
   @EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
   @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
   public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http
               .csrf().disable()
               .authorizeRequests()
               .antMatchers("/testUrl").hasRole("NON_EXISTING")
               .anyRequest().authenticated();
       }
   }
  </code></pre>
  
  <p>Obviously the test URL should not be accessible as my user is not member of role <code>NON_EXISTING</code>. Unfortunatelly she is. </p>
  
  <p>If I move the security <code>authorizeRequests()</code> part to the configuration class form 1. next to adding the security filter then it blocks the access as expected. But in my case it looks like the second configuration is ignored.</p>
  
  <p>I also debugged the <code>configure()</code> methods and noticed that <code>HttpSecurity</code> is not the same object which smells a bit. </p>
  
  <p>Any tips how can I make this work much appreciated.</p>
  
  <p>Sum up of the goal:</p>
  
  <ul>
  <li>have one <code>WebSecurityConfigurerAdapter</code> which adds the filter and is hidden from the user of the <em>library</em></li>
  <li>let the user define her own custom endpoint security</li>
  </ul>
  
  <p>Spring boot 1.1.6-RELEASE</p>