title: spring boot basic http authentication with multiple roles throws 403 forbidden error
body: <p>I am trying to configure spring boot-Embedded Tomcat basic HTTP authentication with multiple roles, with most of the url's similar but few of them specific to each role. Here for first role the basic HTTP authentication pops up and working fine. With below code,</p>
  
  <pre><code>    @Configuration
      @EnableWebMvcSecurity
      @EnableGlobalMethodSecurity(prePostEnabled = true)
  
  public class TestSecurityAdapter extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.csrf().disable()
                  .authorizeRequests().antMatchers(null, getAppAdminRolePaths()).authenticated()
                  .anyRequest().hasAnyRole("APPADMIN")
                  .and()
                  .httpBasic();
  
          http.csrf().disable()
                  .authorizeRequests().antMatchers(null, getAppUserRolePaths()).authenticated()
                  .anyRequest().hasAnyRole("APPUSER")
                  .and()
                  .httpBasic();
  
          http.authorizeRequests().antMatchers(null, new String[]{"/app/appOwnerView.html"}).authenticated()
                  .anyRequest().hasAnyRole("APPOWNER")
                  .and()
                  .httpBasic();
      }
  
      @Override
      @Autowired
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication().withUser("appadminname").password("appadminpwd").roles("APPADMIN").and()
          .withUser("appusername").password("appuserpwd").roles("APPUSER").and()
          .withUser("appownername").password("appoownerpwd").roles("APPOWNER");
      }
  
      private static String[] getAppAdminRolePaths(){
          return new String[]{"/appweb/*",
                  "/app/checkService.html",               
                  "/app/index.html",                
                  "/app/testData.html",    
                  "/app/adminView.html", 
                  "/app/demo.html"};
      }
  
      private static String[] getAppUserRolePaths(){
          return new String[]{"/appweb/*",
                  "/app/checkService.html",               
                  "/app/index.html",                
                  "/app/testData.html",    
                  "/app/userView.html", 
                  "/app/demo.html"};
      }
  }
  </code></pre>
  
  <p>For HTTP username/password popup in browser with url <a href="http://localhost:8080/app/index.html" rel="nofollow">http://localhost:8080/app/index.html</a> say  with <strong>appadminname/appadminpwd</strong> it works fine. But for same url if I enter <strong>appusername/appuserpwd</strong> it throws <strong><em>HTTP 403 Forbidden access error</em></strong>. Here why is the second role APPUSER configured is throwing this error is I am not sure. Please let know if some way to get this resolved.</p>
  
  <p>Thanks</p>