title: Spring 3.0 security not working with annotation based controllers
body: <p>I am trying to add authentication support to my Spring 3.0 web application but nothing from http:basic to more elaborate authentication is working. the examples provided in Spring documentation do not work.</p>
  
  <p>is there a different way of enabling security when using annotated controllers?</p>
  
  <p>I have springSecurityFilterChain mapping in web.xml, i've got spring security jar files in my library.</p>
  
  <p>web.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
  
      &lt;!--
          Key of the system property that should specify the root directory of this
          web app. Applied by WebAppRootListener or Log4jConfigListener.
      --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;webAppRootKey&lt;/param-name&gt;
          &lt;param-value&gt;WebIDE.root&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- Reads request input using UTF-8 encoding --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.CharacterEncodingFilter&lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;encoding&lt;/param-name&gt;
              &lt;param-value&gt;UTF-8&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;forceEncoding&lt;/param-name&gt;
              &lt;param-value&gt;true&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Map URL for views: display /index instead of /app/index as
            suggested by the dispatcher --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.tuckey.web.filters.urlrewrite.UrlRewriteFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;UrlRewriteFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
  
      &lt;!-- The definition of the Root Spring Container shared by all Servlets and Filters --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/app-config.xml
          /WEB-INF/applicationContext-security.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
    &lt;context-param&gt;
      &lt;param-name&gt;log4jConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/classes/log4j.properties&lt;/param-value&gt;
    &lt;/context-param&gt;
  
    &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.util.Log4jConfigListener&lt;/listener-class&gt;
    &lt;/listener&gt;
  
  
      &lt;!-- Mapping required for the security feature to work --&gt;
     &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
      &lt;!-- Creates the Spring Container shared by all Servlets and Filters --&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;!-- set up dispatcher servlet --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;app dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/mvc-config.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;app dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/app/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;mime-mapping&gt;
          &lt;extension&gt;jnlp&lt;/extension&gt;
          &lt;mime-type&gt;application/x-java-jnlp-file&lt;/mime-type&gt;
      &lt;/mime-mapping&gt;
  
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
  
      &lt;/web-app&gt;
  </code></pre>
  
  <p>application-security.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
             http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
             http://www.springframework.org/schema/security
             http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
  &lt;!-- enable web security for defined roles --&gt;
  
    &lt;http auto-config='true'&gt;
      &lt;intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;
      &lt;intercept-url pattern="/**" access="ROLE_USER" /&gt;
      &lt;form-login login-page='/login.jsp' default-target-url='/'  /&gt;
    &lt;/http&gt;
  
  
  &lt;!-- define test logins TO REMOVE --&gt;
   &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
        &lt;user-service&gt;
          &lt;user name="jimi" password="jimi" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
          &lt;user name="bob" password="bob" authorities="ROLE_USER" /&gt;
        &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
    &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>log4j.properties</p>
  
  <pre><code>log4j.rootLogger=DEBUG, stdout, logfile
  
  log4j.appender.stdout=org.apache.log4j.ConsoleAppender
  log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
  log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - &lt;%m&gt;%n
  
  log4j.appender.logfile=org.apache.log4j.RollingFileAppender
  log4j.appender.logfile.File=${WebIDE.root}\WEB-INF\resources\WebIDE.log
  log4j.appender.logfile.MaxFileSize=512KB
  # Keep three backup files.
  log4j.appender.logfile.MaxBackupIndex=3
  # Pattern to output: date priority [category] - message
  log4j.appender.logfile.layout=org.apache.log4j.PatternLayout
  log4j.appender.logfile.layout.ConversionPattern=%d %p [%c] - %m%n
  
  log4j.logger.org.springframework.security=DEBUG
  </code></pre>
  
  <p>all my jsp files are saved in WEB-INF/views/</p>
  
  <p>DEBUGGING INFO </p>
  
  <pre><code>DEBUG [org.springframework.web.filter.DelegatingFilterProxy] - Initializing filter 'springSecurityFilterChain'
  
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean org.springframework.security.filterChainProxy'
  
  DEBUG [org.springframework.web.filter.DelegatingFilterProxy] - Filter 'springSecurityFilterChain' configured successfully
  
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean'org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler#0'
  
  DEBUG[org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource] - Adding web access control expression 'ROLE_USER',  for Ant [pattern='/']
  DEBUG[org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource] - Adding web access control expression 'ROLE_USER', for org.springframework.security.web.util.AnyRequestMatcher@2433a1
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Finished creating instance of bean '(inner bean)#6'
  
  INFO [org.springframework.security.config.http.DefaultFilterChainValidator] - Checking whether login URL '/spring_security_login' is accessible with your configuration
  DEBUG [org.springframework.security.config.http.DefaultFilterChainValidator] - Default generated login page is in use
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Finished creating instance of bean 'org.springframework.security.filterChainProxy'
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean 'org.springframework.security.provisioning.InMemoryUserDetailsManager#0'
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean 'org.springframework.security.authentication.dao.DaoAuthenticationProvider#0'
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean 'org.springframework.security.authentication.DefaultAuthenticationEventPublisher#0'
  2010-11-29 07:57:58,744 DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean 'org.springframework.security.authenticationManager'
  
  DEBUG [org.springframework.web.context.support.XmlWebApplicationContext] - Unable to locate LifecycleProcessor with name 'lifecycleProcessor': using default 
  
  [org.springframework.context.support.DefaultLifecycleProcessor@ca2c3d]
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean 'lifecycleProcessor'
  DEBUG [org.springframework.web.context.ContextLoader] - Published root WebApplicationContext as ServletContext attribute with name 
  
  [org.springframework.web.context.WebApplicationContext.ROOT]
  INFO [org.springframework.web.context.ContextLoader] - Root WebApplicationContext: initialization completed in 9316 ms
  DEBUG [org.springframework.web.filter.CharacterEncodingFilter] - Initializing filter 'characterEncodingFilter'
  DEBUG [org.springframework.web.filter.CharacterEncodingFilter] - Filter 'characterEncodingFilter' configured successfully
  DEBUG [org.springframework.web.filter.DelegatingFilterProxy] - Initializing filter 'springSecurityFilterChain'
  DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory] - Returning cached instance of singleton bean 'org.springframework.security.filterChainProxy'
  DEBUG [org.springframework.web.filter.DelegatingFilterProxy] - Filter 'springSecurityFilterChain' configured successfully
  DEBUG [org.springframework.web.servlet.DispatcherServlet] - Initializing servlet 'app dispatcher'
  INFO [org.springframework.web.servlet.DispatcherServlet] - FrameworkServlet 'app dispatcher': initialization started
  </code></pre>