title: Spring mvc application does not start in Tomcat when i add global-method-security
body: <p>I am trying add method level security to my Spring MCV/Security. The application works if don't add
  <code>&lt;security:global-method-security pre-post-annotations="enabled"/&gt;</code>.</p>
  
  <p>I want method level security on controller methods which have request mappings </p>
  
  <p>Tomcat error</p>
  
  <p>FAIL - Application at context path /commerce could not be started</p>
  
  <p><strong>This is my folder structure.</strong></p>
  
  <p><img src="https://i.stack.imgur.com/ukEAA.png" alt="enter image description here"></p>
  
  <p>Here are all my files.</p>
  
  <p><strong>spring-servlet.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:p="http://www.springframework.org/schema/p" xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd"&gt;
  
      &lt;!-- Declare a view resolver --&gt;
      &lt;bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver" 
              p:prefix="/WEB-INF/jsp/" p:suffix=".jsp" /&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:security="http://www.springframework.org/schema/security"
      xmlns:p="http://www.springframework.org/schema/p"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/security 
              http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
      &lt;!-- This is where we configure Spring-Security  --&gt;
  
      &lt;security:http auto-config="false"
                     use-expressions="true"
                     access-denied-page="/auth/denied"
                     entry-point-ref="authenticationEntryPoint" &gt;
  
          &lt;security:intercept-url pattern="/auth/login" access="permitAll"/&gt;
          &lt;security:intercept-url pattern="/main/admin" access="hasRole('ROLE_ADMIN')"/&gt;
          &lt;security:intercept-url pattern="/main/common" access="hasRole('ROLE_USER')"/&gt;
  
          &lt;security:logout invalidate-session="true"
                           logout-success-url="/auth/login"
                           logout-url="/auth/logout"/&gt;
  
          &lt;security:custom-filter ref="blacklistFilter" before="FILTER_SECURITY_INTERCEPTOR"/&gt;
          &lt;security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/&gt;
      &lt;/security:http&gt;
  
  
  
      &lt;!--  Custom filter to deny unwanted users even though registered --&gt;
      &lt;bean id="blacklistFilter" class="org.krams.commerce.filter.BlacklistFilter" /&gt;
  
      &lt;!-- Custom filter for username and password. The real customization is done in the customAthenticationManager --&gt;
      &lt;bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
          p:authenticationManager-ref="customAuthenticationManager"
          p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
          p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" /&gt;
  
      &lt;!-- Custom authentication manager. In order to authenticate, username and password must not be the same --&gt;
      &lt;bean id="customAuthenticationManager" class="org.krams.commerce.manager.CustomAuthenticationManager" /&gt;
  
      &lt;!-- We just actually need to set the default failure url here --&gt;
      &lt;bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
          p:defaultFailureUrl="/auth/login?error=true" /&gt;
  
       &lt;!-- We just actually need to set the default target url here --&gt;
      &lt;bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
          p:defaultTargetUrl="/main/common" /&gt;
  
      &lt;!-- The AuthenticationEntryPoint is responsible for redirecting the user to a particular page, like a login page,
              whenever the server sends back a response requiring authentication --&gt;
      &lt;!-- See Spring-Security Reference 5.4.1 for more info --&gt;
      &lt;bean id="authenticationEntryPoint"  class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
          p:loginFormUrl="/auth/login"/&gt;
  
      &lt;!-- The tag below has no use but Spring Security needs it to autowire the parent property of
              org.springframework.security.authentication.ProviderManager. Otherwise we get an error 
              A probable bug. This is still under investigation--&gt;
      &lt;security:authentication-manager/&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>applicationContext.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/context
              http://www.springframework.org/schema/context/spring-context-3.0.xsd
              http://www.springframework.org/schema/mvc 
              http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd"&gt;
  
       &lt;security:global-method-security pre-post-annotations="enabled"/&gt;
      &lt;!-- Activates various annotations to be detected in bean classes --&gt;
      &lt;context:annotation-config /&gt;
  
      &lt;!-- Scans the classpath for annotated components that will be auto-registered as Spring beans.
       For example @Controller and @Service. Make sure to set the correct base-package--&gt;
      &lt;context:component-scan base-package="org.krams.commerce" /&gt;
  
      &lt;!-- Configures the annotation-driven Spring MVC Controller programming model.
      Note that, with Spring 3.0, this tag works in Servlet MVC only!  --&gt;
      &lt;mvc:annotation-driven /&gt; 
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>pom.xml</strong></p>
  
  <pre><code>&lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"&gt;
    &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
    &lt;groupId&gt;org.krams.tutorial&lt;/groupId&gt;
    &lt;artifactId&gt;commerce&lt;/artifactId&gt;
    &lt;packaging&gt;war&lt;/packaging&gt;
    &lt;version&gt;1.0.0-SNAPSHOT&lt;/version&gt;
    &lt;name&gt;commerce&lt;/name&gt;
    &lt;url&gt;http://maven.apache.org&lt;/url&gt;
    &lt;dependencies&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;junit&lt;/groupId&gt;
          &lt;artifactId&gt;junit&lt;/artifactId&gt;
          &lt;version&gt;4.8.1&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-core&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;log4j&lt;/groupId&gt;
          &lt;artifactId&gt;log4j&lt;/artifactId&gt;
          &lt;version&gt;1.2.14&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-tx&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;jstl&lt;/groupId&gt;
          &lt;artifactId&gt;jstl&lt;/artifactId&gt;
          &lt;version&gt;1.1.2&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;taglibs&lt;/groupId&gt;
          &lt;artifactId&gt;standard&lt;/artifactId&gt;
          &lt;version&gt;1.1.2&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
          &lt;artifactId&gt;spring-aop&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
          &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
          &lt;version&gt;3.0.5.RELEASE&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
          &lt;artifactId&gt;servlet-api&lt;/artifactId&gt;
          &lt;version&gt;2.5&lt;/version&gt;
          &lt;type&gt;jar&lt;/type&gt;
          &lt;scope&gt;compile&lt;/scope&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.mongodb&lt;/groupId&gt;
          &lt;artifactId&gt;mongo-java-driver&lt;/artifactId&gt;
          &lt;version&gt;1.3&lt;/version&gt;
      &lt;/dependency&gt;
  
    &lt;/dependencies&gt;
    &lt;build&gt;
      &lt;finalName&gt;commerce&lt;/finalName&gt;
    &lt;/build&gt;
  &lt;/project&gt;
  </code></pre>
  
  <p><strong>web.xml</strong> </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
      &lt;filter&gt;
              &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
              &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
              &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
          /WEB-INF/spring-security.xml
          /WEB-INF/applicationContext.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>The error in tomcat is catalina.out is:</strong></p>
  
  <pre><code>Aug 6, 2013 5:00:41 PM org.apache.catalina.loader.WebappClassLoader validateJarFile
  INFO: validateJarFile(/opt/apache-tomcat-7.0.42/webapps/commerce/WEB-INF/lib/servlet-api-2.5.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
  [ERROR] [http-bio-80-exec-382 05:00:41] (ContextLoader.java:initWebApplicationContext:220) Context initialization failed
  org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 16 in XML document from ServletContext resource [/WEB-INF/applicationContext.xml] is invalid; nested exception is org.xml.sax.SAXParseException; lineNumber: 16; columnNumber: 65; cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'security:global-method-security'.
          at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:396)
          at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334)
          at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:302)
          at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:143)
          at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:178)
          at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:149)
          at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:124)
          at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:93)
          at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:130)
          at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:467)
          at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:397)
          at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:276)
          at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:197)
          at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)
          at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4939)
          at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5434)
          at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
          at org.apache.catalina.manager.ManagerServlet.start(ManagerServlet.java:1256)
          at org.apache.catalina.manager.HTMLManagerServlet.start(HTMLManagerServlet.java:714)
          at org.apache.catalina.manager.HTMLManagerServlet.doPost(HTMLManagerServlet.java:219)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:647)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
          at org.apache.catalina.filters.CsrfPreventionFilter.doFilter(CsrfPreventionFilter.java:212)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
          at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:108)
          at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
          at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
          at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
          at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:611)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
          at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
          at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1023)
          at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
          at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1146)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
          at java.lang.Thread.run(Thread.java:679)
  Caused by: org.xml.sax.SAXParseException; lineNumber: 16; columnNumber: 65; cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'security:global-method-security'.
          at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.createSAXParseException(ErrorHandlerWrapper.java:198)
          at com.sun.org.apache.xerces.internal.util.ErrorHandlerWrapper.error(ErrorHandlerWrapper.java:134)
          at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(
          at com.sun.org.apache.xerces.internal.impl.XMLErrorReporter.reportError(
          at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator$XSIErro
          at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.reportS
          at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.handleS
          at com.sun.org.apache.xerces.internal.impl.xs.XMLSchemaValidator.emptyEl
          at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.scan
          at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImp
          at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(X
          at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next
          at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImp
          at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(X
          at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(X
          at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.
          at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.
          at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(Doc
          at org.springframework.beans.factory.xml.DefaultDocumentLoader.loadDocum
          at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadB
          ... 43 more
  Aug 6, 2013 5:00:41 PM org.apache.catalina.core.StandardContext startInternal
  SEVERE: Error listenerStart
  Aug 6, 2013 5:00:41 PM org.apache.catalina.core.StandardContext startInternal
  SEVERE: Context [/commerce] startup failed due to previous errors
  </code></pre>
  
  <p><strong>Thanks you in advance</strong></p>