title: Adding Spring Security to an existing Spring Web App (using JavaConfig)
body: <p>I have a Spring MVC Rest Web App for which I'm in the process of adding a layer of Spring Security.</p>
  
  <p>While I'm going through the <a href="http://docs.spring.io/spring-security/site/docs/3.2.0.RELEASE/reference/htmlsingle/#abstractsecuritywebapplicationinitializer-with-spring-mvc" rel="nofollow">Spring documentation</a>, I'm unable to pickup the meaning of Section 3.1.3. I'm copy/pasting the contents of the section below.</p>
  
  <pre><code>If we were using Spring elsewhere in our application we probably already had a WebApplicationInitializer that is loading our Spring Configuration. If we use the previous configuration we would get an error. Instead, we should register Spring Security with the existing ApplicationContext. For example, if we were using Spring MVC our SecurityWebApplicationInitializer would look something like the following:
  
  import org.springframework.security.web.context.*;
  
  public class SecurityWebApplicationInitializer
        extends AbstractSecurityWebApplicationInitializer {
  
  }
  
  This would simply only register the springSecurityFilterChain Filter for every URL in your application. After that we would ensure that SecurityConfig was loaded in our existing ApplicationInitializer. For example, if we were using Spring MVC it would be added in the getRootConfigClasses()
  
  public class MvcWebApplicationInitializer extends
          AbstractAnnotationConfigDispatcherServletInitializer {
  
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {
          return new Class[] { SecurityConfig.class };
      }
  
      // ... other overrides ...
  }
  </code></pre>
  
  <p>So, I already have the following</p>
  
  <pre><code>an Initializer.java (replacement of web.xml)
  Config.java - Root Context
  RestServlet.java - Servlet Context
  </code></pre>
  
  <p>Here is my Initializer.java</p>
  
  <pre><code>public class Initializer implements WebApplicationInitializer {
  
      public void onStartup(ServletContext container) throws ServletException {
  
        // Create the 'root' Spring application context
        AnnotationConfigWebApplicationContext rootContext =
          new AnnotationConfigWebApplicationContext();
        rootContext.register(Config.class);
  
        // Manage the lifecycle of the root application context
        container.addListener(new ContextLoaderListener(rootContext));
  //      container.addListener(new ContextLoaderListener(rootContext));
  
        // Create the dispatcher servlet's Spring application context
        AnnotationConfigWebApplicationContext dispatcherContext =
          new AnnotationConfigWebApplicationContext();
        dispatcherContext.register(RestServlet.class);
  
        // Register and map the dispatcher servlet
        ServletRegistration.Dynamic dispatcher =
          container.addServlet("dispatcher", new DispatcherServlet(dispatcherContext));
        dispatcher.setLoadOnStartup(1);
        dispatcher.addMapping("/");
  
  
      }
   }
  </code></pre>
  
  <p>To add the Spring Security layer, I added the following </p>
  
  <pre><code>SecurityConfig.java
  SecurityInitializer.java
  </code></pre>
  
  <p>SecurityConfig.java (This is to test using in memory auth details).</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
         @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER");
      }
  }
  </code></pre>
  
  <p>SecurityInitializer.java</p>
  
  <pre><code>public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer
                {
  
  
      protected Class&lt;?&gt;[] getRootConfigClasses() {
          return new Class[] { SecurityConfig.class };
      }
  </code></pre>
  
  <p>Now, the problem is that I'm unsure about how to perform these steps. I don't know (based on section 3.2.3 of docs) if I should extend AbstractSecurityWebApplicationInitializer  or AbstractAnnotationConfigDispatcherServletInitializer.</p>
  
  <p>Another issue is that this is a REST application. I do not have any controllers that return jsps (and I do not want to!). My end goal is to use OAuth2, generate and issue tokens to the frontend webapp (based on Angular) and secure the REST api this way. Also add Facebook and Google+ login on top of this. But I'm taking baby steps with spring security and I'm stuck here. Wondering if any of those who have taken this path already can share their wisdom.</p>