title: How to get security=none for localhost (jetty) and spring security otherwise?
body: <p>I'm very new to Spring and a bit of a newb in java as well so I may be missing something obvious.  We deploy to WAS for UAT and prod but are starting to move to embedded jetty as our apps are pretty lightweight.</p>
  
  <p>Soooo ... we've been hacking our web.xml to comment out the <code>&lt;filter&gt;</code> tags and commenting out the  for spring security.xml in application context.  Not ideal as we use maven.  So as a learning exercise I'm trying to get this to work tidily and been reading a lot of blogs and questions here and, frankly, getting confused.</p>
  
  <p>My first try was to leave the <code>&lt;filter&gt;</code> in web.xml and create a new beans <code>profile="jettyLocal"</code> with <code>http auto-config="true" security="none"</code>.  Then I start jetty from RTC with <code>-Dspring.profiles.active="JettyLocal"</code>.  This seems to have no effect.  I.e. with or without that I still get a chain of exceptions - "no authentication manager" and error creating the spring filterChains bean.</p>
  
  <p>Is the problem that web.xml is loaded before the <code>-Dspring..</code> is processed?  Am I asking the wrong question?  Happy to RTFM if you can give me pointers.  I have Spring in Action 3.0 but can't see anything relevant, maybe due to my lack of experience.</p>
  
  <p>eta:  To clarify as I was unclear.  I have the app working nicely with Spring-security on an external WAS with AD security, a localhost WAS with a user-service tag giving a hardcoded user name managed by named profile beans.  What I am struggling with is keeping those 2 but having no security for running quick tests with jetty:run.
  Thanks for the suggestions thus far. All good reading.</p>
  
  <p>eta 2: The samples I can find all assume I'll be testing a whole web app with logon pages etc.  But I want to use jetty:run for quick tests of classes or packages that can respond to web calls using a simple test harness.</p>
  
  <p>eta 3: I've managed to get close enough to what I want by adding to spring-security.xml</p>
  
  <pre><code>&lt;beans:beans profile="dev"&gt;
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="xxx" password="xxx" authorities="xxx" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>
  and starting jetty with -Dspring.profiles.active="dev"</p>