title: Tomcat 7 and AbstractSecurityWebApplicationInitializer are not working together
body: <p>I was following this <a href="http://blog.springsource.org/2013/07/03/spring-security-java-config-preview-web-security/" rel="nofollow">article</a> to try a basic http-auth without the use of a web.xml</p>
  
  <p>I'm using Tomcat 7.0.41 and those are my dependencies on gradle:</p>
  
  <pre><code>  ext.springVersion =  "3.2.1.RELEASE"
    compile "org.springframework:spring-jdbc:$springVersion",
            "org.springframework:spring-context:$springVersion",
            "org.springframework:spring-web:$springVersion",
            "org.springframework:spring-webmvc:$springVersion",
            "org.springframework.security:spring-security-core:3.2.0.M2",
            "org.springframework.security:spring-security-web:3.2.0.M2",
            "org.springframework.security:spring-security-config:3.2.0.M2",
  </code></pre>
  
  <p>According to the tutorial I defined the following </p>
  
  <pre><code>@EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void registerAuthentication(AuthenticationManagerBuilder auth)
              throws Exception {
          auth.inMemoryAuthentication().withUser("admin").password("admin")
                  .roles("USER");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeUrls().antMatchers("/").hasRole("USER")
                  .and().httpBasic();
      }
  
  }
  </code></pre>
  
  <p>then added that class to the initializer like this:</p>
  
  <pre><code>@Order(1)
  public class ServletConfiguration extends
          AbstractAnnotationConfigDispatcherServletInitializer {
  
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {
          return new Class[] { SecurityConfiguration.class };
          // return null;
      }
  
      @Override
      protected Class&lt;?&gt;[] getServletConfigClasses() {
          return new Class[] { AppConfiguration.class };
      }
  
      @Override
      protected String[] getServletMappings() {
          return new String[] { "/" };
      }
  
  //  @Override
  //  protected Dynamic registerServletFilter(ServletContext servletContext,
  //          Filter filter) {
  //      Dynamic securityFilter = servletContext.addFilter(
  //              "springSecurityFilterChain", DelegatingFilterProxy.class);
  //      securityFilter.addMappingForUrlPatterns(
  //              EnumSet.allOf(DispatcherType.class), false, "/*");
  //      return securityFilter;
  //  }
  
  }
  </code></pre>
  
  <p>and finally added a class to inizialize the springSecurityFilterChain:</p>
  
  <pre><code>@Order(2)
  public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer  {
  @Override
  protected void afterSpringSecurityFilterChain(ServletContext servletContext) {
      System.out.println("afterSpringSecurityFilterChain");
      super.afterSpringSecurityFilterChain(servletContext);
  }
  }
  </code></pre>
  
  <p>But I'm always getting this error:</p>
  
  <pre><code>DEBUG: org.springframework.jndi.JndiPropertySource - JNDI lookup for name [spring.liveBeansView.mbeanDomain] threw NamingException with message: Name [spring.liveBeansView.mbeanDomain] is not bound in this Context. Unable to find [spring.liveBeansView.mbeanDomain].. Returning null.
  Jul 11, 2013 9:22:24 PM org.apache.catalina.core.StandardContext filterStart
  SEVERE: Exception starting filter springSecurityFilterChain
  org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'springSecurityFilterChain' is defined
  </code></pre>
  
  <p>I don't why though, because when I go debugging the server initialization, actually these two methods are called:</p>
  
  <pre><code>@Override
  public final void onStartup(ServletContext servletContext)
          throws ServletException {
      if(enableHttpSessionEventPublisher()) {
          servletContext.addListener(HttpSessionEventPublisher.class);
      }
      insertSpringSecurityFilterChain(servletContext);
      afterSpringSecurityFilterChain(servletContext);
  }
  </code></pre>
  
  <p>then</p>
  
  <pre><code>private void insertSpringSecurityFilterChain(ServletContext servletContext) {
      String filterName = "springSecurityFilterChain";
      DelegatingFilterProxy springSecurityFilterChain = new DelegatingFilterProxy(filterName);
      String contextAttribute = getWebApplicationContextAttribute();
      if(contextAttribute != null) {
          springSecurityFilterChain.setContextAttribute(contextAttribute);
      }
      registerFilter(servletContext, true, filterName, springSecurityFilterChain);
  }
  </code></pre>
  
  <p>So actually the filter gets created. But then it gets lost somewhere.</p>
  
  <p>I tried to play with <code>@Order</code>, but that was doing nothing so I tried to register <code>springSecurityFilterChain</code> using the <code>registerServletFilter</code> method but I'm not getting any http-auth request authentication.
  And also <code>SecurityConfiguration</code> doens't even get loaded.</p>