title: configure(HttpSecurity http) and configure(AuthenticationManagerBuilder) get ignored with certain annotations in WebSecurityConfigurerAdapter
body: <p>I'm trying to secure my spring application that has  different user roles. While the Authentication part is set and works flawlessly, I realised during the implementation of the Authorisation part that with certain annotations, one of the two overrides methods inside my <code>SecurityConfiguration extends WebSecurityConfigurerAdapter class</code>, gets ignored.</p>
  <pre><code>public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
    @Autowired
    private WebApplicationContext applicationContext;
    private CredentialsService userDetailsService;
  
    @Autowired
    private DataSource dataSource;
  
    @PostConstruct
    public void completeSetup() {
      userDetailsService =   applicationContext.getBean(CredentialsService.class);
    }
  
    @Override
    protected void configure(final HttpSecurity http) throws Exception {
      http.authorizeRequests()
              .antMatchers(&quot;/login&quot;)
              .permitAll()
              .and()
              .formLogin()
              .permitAll()
              .and()
  
              .httpBasic()
              .disable()
  
              .authorizeRequests()
              .antMatchers(&quot;/admin&quot;, &quot;/admin/**&quot;)
              .hasRole(&quot;ADMIN&quot;)
              .and()
  
              .authorizeRequests()
              .antMatchers(&quot;/employee&quot;, &quot;/employee/**&quot;)
              .hasRole(&quot;EMPLOYEE&quot;)
              .and()
  
              .authorizeRequests()
              .antMatchers(&quot;/customer&quot;, &quot;/customer/**&quot;)
              .hasRole(&quot;CUSTOMER&quot;);
    }
  
    @Override
    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(userDetailsService)
              .passwordEncoder(encoder())
              .and()
              .authenticationProvider(authenticationProvider())
              .jdbcAuthentication()
              .dataSource(dataSource);
    }
  
  
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
      final DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
      authProvider.setUserDetailsService(userDetailsService);
      authProvider.setPasswordEncoder(encoder());
      return authProvider;
    }
  
    @Bean
    public PasswordEncoder encoder() {
      return new BCryptPasswordEncoder(12);
    }
  }
  </code></pre>
  <p>Now the problem is the following, as it is, this class authenticate my users but has one major drawback: the</p>
  <pre><code>configure(final HttpSecurity http) throws Exception {
  </code></pre>
  <p>gets completely ignored.</p>
  <p>On the other side though, if I add the @Configuration annotation on top of my class, the</p>
  <pre><code>protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
  </code></pre>
  <p>gets completely ignored, hence will break the authorisation as it won't be able to call the getUsername() and getPassword on my custom <code>UserDetailsService</code> implementation.</p>
  <p>As you can see, I've used a <code>DaoAuthenticationProvider</code> instance as authenticationProvider, since my application retrieve the users/password from an external database.</p>
  <p>The quick fix I adopted right now it's the addition of the following method on my main class</p>
  <pre><code>@EnableGlobalMethodSecurity(
          securedEnabled = true,
          jsr250Enabled = true,
          prePostEnabled = true
  )
  </code></pre>
  <p>and the use of the <code>@Secured</code> annotation on my restricted controllers. That works, but I'd like to understand why Spring has such strange behaviour and what step can I take to address these problems.</p>