title: Spring security configuration error: beans have the same 'order' value
body: <p>I have a Web Application in which i am implementing spring security my <code>spring-security.xml</code> is</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
                          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                          http://www.springframework.org/schema/security
                          http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
      &lt;!-- ENABLE HTTP SECURITY --&gt;
      &lt;http auto-config="false" access-denied-page="/accessDenied.html"&gt;
  
          &lt;!-- INTERCEPT URL FOR RESOURCES ACCESS --&gt;
          &lt;intercept-url pattern="/admin/" access="hasRole('ADMIN_ROLE')" /&gt;
          &lt;intercept-url pattern="/users/" access="hasRole('USER_ROLE')" /&gt;
          &lt;intercept-url pattern="/**" access="permitAll" /&gt;
  
          &lt;!-- CUSTOME FILTER --&gt;
          &lt;custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /&gt;
          &lt;custom-filter position="FORM_LOGIN_FILTER" ref="AuthFilter" /&gt;
  
          &lt;!-- SESSION MANAGEMENT CONFIG --&gt;
          &lt;session-management
              session-authentication-strategy-ref="session-management" /&gt;
  
          &lt;!-- FORM LOGIN CONFIG --&gt;
          &lt;form-login login-page="/loginForm"
              authentication-failure-url="/error.html" default-target-url="/welcome.html" /&gt;
          &lt;logout logout-success-url="/loggedout.html"
              invalidate-session="true" /&gt;
      &lt;/http&gt;
      &lt;!-- SERVICES  --&gt;
      &lt;beans:bean id="customEncoder" class="com.rep.security.CustomPasswordEncoder"&gt;&lt;/beans:bean&gt;
      &lt;beans:bean id="customUserService" class="com.rep.security.CustomUserDetailService"&gt;&lt;/beans:bean&gt;
  
      &lt;!-- AUTHENICATION MANAGER CONFIG --&gt;
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider user-service-ref="customUserService"&gt;
              &lt;password-encoder ref="customEncoder"&gt;&lt;/password-encoder&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;!-- CONCURRENCY FILEER CONFIG --&gt;
      &lt;beans:bean id="concurrencyFilter"
          class="org.springframework.security.web.session.ConcurrentSessionFilter"&gt;
          &lt;beans:property name="sessionRegistry" ref="sessionRegistry" /&gt;
          &lt;beans:property name="expiredUrl" value="/timeout.html" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="AuthFilter"
          class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
          &lt;beans:property name="sessionAuthenticationStrategy"
              ref="session-management" /&gt;
          &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="session-management"
          class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"&gt;
          &lt;beans:constructor-arg name="sessionRegistry"
              ref="sessionRegistry" /&gt;
          &lt;beans:property name="maximumSessions" value="1" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="sessionRegistry"
          class="org.springframework.security.core.session.SessionRegistryImpl" /&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>At the time of running the application on jboss i am facing this error </p>
  
  <pre><code>15:40:02,470 ERROR [org.springframework.web.context.ContextLoader] (ServerService Thread Pool -- 59) Context initialization failed: org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Filter beans '&lt;AuthFilter&gt;' and 'Root bean: class [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null' have the same 'order' value. When using custom filters, please make sure the positions do not conflict with default filters. Alternatively you can disable the default filters by removing the corresponding child elements from &lt;http&gt; and avoiding the use of &lt;http auto-config='true'&gt;.
  </code></pre>
  
  <p>Can any one tell me what is problem configuration i am following [Spring Doc ioc] for <a href="http://docs.spring.io/spring-security/site/docs/3.1.6.RELEASE/reference/session-mgmt.html" rel="noreferrer">session management</a></p>