title: Password protecting two web pages with Spring 3.1
body: <p>I keep finding questions already asked that are close to mine, but can't seem to find the exact answer I'm looking for.  I'm guessing the solution for what I want to do is fairly simple.</p>
  
  <p>I have a web site with a default page (index.jsp).  There is a link from the index page to an admin page (admin.jsp).  This page has been password protected for a long time with Spring without issue.  Here is the security context file I've been using:</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://www.springframework.org/schema/beans 
                      http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                      http://www.springframework.org/schema/security 
                      http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
      &lt;global-method-security pre-post-annotations="enabled" secured-annotations="enabled"/&gt;     
  
      &lt;http use-expressions="true"&gt;
          &lt;intercept-url pattern="/admin.jsp" access="hasRole('administrator')" /&gt;
          &lt;intercept-url pattern="/**" access="permitAll" /&gt;
          &lt;form-login login-page="/login.jsp" default-target-url="/admin.jsp" /&gt;
          &lt;logout /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="${admin.username}" password="${admin.password}" authorities="administrator" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;   
  </code></pre>
  
  <p>I now have a need to password protect index.jsp as well.  If I duplicate the child elements for the  element (and I created separate login.jsp files, not sure if that's necessary) like this:</p>
  
  <pre><code>&lt;http use-expressions="true"&gt;
          &lt;intercept-url pattern="/index.jsp" access="hasRole('user')" /&gt;
          &lt;form-login login-page="/indexLogin.jsp" default-target-url="/index.jsp" /&gt;
          &lt;logout /&gt;
  
          &lt;intercept-url pattern="/admin.jsp" access="hasRole('administrator')" /&gt;
          &lt;form-login login-page="/adminLogin.jsp" default-target-url="/admin.jsp" /&gt;
          &lt;logout /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="${admin.username}" password="${admin.password}" authorities="administrator" /&gt;
                  &lt;user name="${user.username}" password="${user.password}" authorities="user" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>Then the index.jsp is password protected exactly as expected.  However, if I click on the button that opens the admin.jsp page in a new tab, i get a 403 - Access is denied error.  I'm assuming that's because it's automatically trying to use the user credentials on the admin page.</p>
  
  <p>I then tried creating two separate  elements, each with the elements for each different page:</p>
  
  <pre><code>&lt;http use-expressions="true"&gt;
          &lt;intercept-url pattern="/index.jsp" access="hasRole('user')" /&gt;
          &lt;form-login login-page="/indexLogin.jsp" default-target-url="/index.jsp" /&gt;
          &lt;logout /&gt;
      &lt;/http&gt;
  
      &lt;http use-expressions="true"&gt;
          &lt;intercept-url pattern="/admin.jsp" access="hasRole('administrator')" /&gt;
          &lt;form-login login-page="/adminLogin.jsp" default-target-url="/admin.jsp" /&gt;
          &lt;logout /&gt;
      &lt;/http&gt;
  </code></pre>
  
  <p>Then I get an error stating:</p>
  
  <p>java.lang.IllegalArgumentException: A universal match pattern ('/**') is defined  before other patterns in the filter chain, causing them to be ignored. Please check the ordering in your  namespace or FilterChainProxy bean configuration</p>
  
  <p>Can anybody give me a pointer on how to force Spring to prompt for credentials each time it access either index.jsp or admin.jsp, and not assume that the existing credentials should be used?</p>