title: Can I use both a GlobalMethodSecurityConfiguration and a WebSecurityConfigurerAdapter in a Spring app
body: <p>My application has both a GlobalMethodSecurityConfiguration and a WebSecurityConfigurerAdapter configuration classes. My implementations are given below:</p>
  
  <p>My <strong>GlobalMethodSecurityConfiguration implementation</strong>:</p>
  
  <pre><code>@Configuration
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class MethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {
  
      @Override
      protected AuthenticationManager authenticationManager() {
          AuthenticationManager authenticationManager = new ProviderManager();
          return authenticationManager;
      }
  
      @Override
      protected MethodSecurityExpressionHandler createExpressionHandler() {
          DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
          expressionHandler.setPermissionEvaluator(permissionEvaluator());
          return expressionHandler;
      }
  
      @Bean
      public ApplicationPermissionEvaluator permissionEvaluator() {
          return new ApplicationPermissionEvaluator(permissionMap());
      }
  
      private Map&lt;String, Permission&gt; permissionMap() {
          Map&lt;String, Permission&gt; map = new HashMap&lt;&gt;();
          map.put("CurriculumService:findCurriculumIsAllowed", curriculumByIdOwnerPermission());
          map.put("CurriculumService:updateCurriculumIsAllowed", curriculumOwnerPermission());
  
          return map;
      }
  
      @Bean(autowire=Autowire.BY_NAME)
      public CurriculumByIdOwnerPermission curriculumByIdOwnerPermission() {
          return new CurriculumByIdOwnerPermission();
      }
  
      @Bean(autowire=Autowire.BY_NAME)
      public CurriculumOwnerPermission curriculumOwnerPermission() {
          return new CurriculumOwnerPermission();
      }
  
  }
  </code></pre>
  
  <p>and my <strong>WebSecurityConfigurerAdapter implementation</strong>:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          //@formatter:off
          http
          //.csrf().disable()
          .exceptionHandling().authenticationEntryPoint(delegatingAuthenticationEntryPoint())
          .and().formLogin()
              .loginProcessingUrl("/signin")
              .loginPage("/signin")
              .failureUrl("/signin?login_error=t")
              .defaultSuccessUrl("/dashboard", Boolean.TRUE)
          .and().logout()
              .logoutUrl("/resources/j_spring_security_logout")
              .logoutSuccessUrl("/signin")
          .and().authorizeRequests()
              .accessDecisionManager(accessDecisionManager())
              .antMatchers("/preference/sendPasswordReset/**", "/preference/passwordReset/**", "/preference/activateEmail/**", "/preference/resendActivationEmail/**").permitAll()
              .antMatchers("/preference/**").access("hasAnyRole('ROLE_BASIC_CHILDMINDER', 'ROLE_BASIC_FAMILY')")
              .antMatchers("/dashboard").access("hasAnyRole('ROLE_BASIC_CHILDMINDER', 'ROLE_BASIC_FAMILY')")
              .antMatchers("/curriculum/**").access("hasRole('ROLE_BASIC_CHILDMINDER')")
              .antMatchers("/advertisement/**/view/**").permitAll()
              .antMatchers("/advertisement/family/**").access("hasRole('ROLE_BASIC_FAMILY')")
              .antMatchers("/advertisement/childminder/**").access("hasRole('ROLE_BASIC_CHILDMINDER')")
              .antMatchers("/resources/**", "/**").permitAll();
          //@formatter:on
          super.configure(http);
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService()).passwordEncoder(passwordEncoder());
      }
  
      @Bean
      public MemberUserDetailsService userDetailsService() {
          return new MemberUserDetailsService();
      }
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder() {
          BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
          return passwordEncoder;
      }
  
      @Bean
      public SessionRegistryImpl sessionRegistry() {
          SessionRegistryImpl sessionRegistry = new SessionRegistryImpl();
          return sessionRegistry;
      }
  
      @Bean
      public AffirmativeBased accessDecisionManager() {
          AffirmativeBased accessDecisionManager = new AffirmativeBased(accessDecisionVoters());
          return accessDecisionManager;
      }
  
      public List&lt;AccessDecisionVoter&gt; accessDecisionVoters() {
          List&lt;AccessDecisionVoter&gt; accessDecisionVoters = new ArrayList&lt;&gt;();
          accessDecisionVoters.add(roleHierarchyVoter());
          accessDecisionVoters.add(webExpressionVoter());
          return accessDecisionVoters;
      }
  
      @Bean
      public WebExpressionVoter webExpressionVoter() {
          WebExpressionVoter webExpressionVoter = new WebExpressionVoter();
          webExpressionVoter.setExpressionHandler(defaultWebSecurityExpressionHandler());
          return webExpressionVoter;
      }
  
      @Bean
      public DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler() {
          DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
          defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy());
          return defaultWebSecurityExpressionHandler;
      }
  
      @Bean
      public RoleHierarchyVoter roleHierarchyVoter() {
          RoleHierarchyVoter roleHierarchyVoter = new RoleHierarchyVoter(roleHierarchy());
          return roleHierarchyVoter;
      }
  
      @Bean
      public RoleHierarchyImpl roleHierarchy() {
          RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
          //@formatter:off
          roleHierarchy.setHierarchy(
                  "ROLE_ADMINISTRATOR &gt; ROLE_MODERATOR\n" +
                  "ROLE_MODERATOR &gt; ROLE_SUBSCRIBED_FAMILY\n" +
                  "ROLE_MODERATOR &gt; ROLE_SUBSCRIBED_CHILDMINDER\n" +
                  "ROLE_SUBSCRIBED_FAMILY &gt; ROLE_BASIC_FAMILY\n" +
                  "ROLE_SUBSCRIBED_CHILDMINDER &gt; ROLE_BASIC_CHILDMINDER");
          //@formatter:on
          return roleHierarchy;
      }
  
      @Bean
      public DelegatingAuthenticationEntryPoint delegatingAuthenticationEntryPoint() {
          DelegatingAuthenticationEntryPoint delegatingAuthenticationEntryPoint = new DelegatingAuthenticationEntryPoint(map());
          delegatingAuthenticationEntryPoint.setDefaultEntryPoint(loginUrlAuthenticationEntryPoint());
          return delegatingAuthenticationEntryPoint;
      }
  
      public LinkedHashMap&lt;RequestMatcher, AuthenticationEntryPoint&gt; map() {
          LinkedHashMap&lt;RequestMatcher, AuthenticationEntryPoint&gt; map = new LinkedHashMap&lt;&gt;();
          map.put(ajaxRequestMatcher(), ajaxAuthenticationEntryPoint());
          return map;
      }
  
      @Bean
      public LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint() {
          LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint = new LoginUrlAuthenticationEntryPoint("/signin");
          return loginUrlAuthenticationEntryPoint;
      }
  
      @Bean
      public AjaxAuthenticationEntryPoint ajaxAuthenticationEntryPoint() {
          AjaxAuthenticationEntryPoint ajaxAuthenticationEntryPoint = new AjaxAuthenticationEntryPoint();
          return ajaxAuthenticationEntryPoint;
      }
  
      @Bean
      public AjaxRequestMatcher ajaxRequestMatcher() {
          AjaxRequestMatcher ajaxRequestMatcher = new AjaxRequestMatcher();
          return ajaxRequestMatcher;
      }
  
      @Bean
      public RequestDataValueProcessor requestDataValueProcessor() {
          return new CsrfRequestDataValueProcessor();
      }
  }
  </code></pre>
  
  <p>I am not sure how to configure the authentication manager. Is the following a correct way of proceeding?</p>
  
  <pre><code> @Override
      protected AuthenticationManager authenticationManager() {
          AuthenticationManager authenticationManager = new ProviderManager();
          return authenticationManager;
      }
  </code></pre>
  
  <p>Any input welcome...</p>