title: Can't get spring-security.xml right
body: <p>I have my spring security set up to do basic authentication to a database with no issues, however I would like to add custom login/logout and admin pages as well as md5 encryption on passwords w/ salt.</p>
  
  <p>I keep hitting walls trying to get either of these features to work, and all the examples online seem to be using  and declaring  like that instead of using bean declarations like I am. This makes it more difficult because options in examples don't seem to directly translate into bean properties.</p>
  
  <p>Here is my web.xml - I am using Spring Security 3.0:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
  &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          /WEB-INF/applicationContext.xml
          /WEB-INF/builder-servlet.xml
          /WEB-INF/builder-service.xml
          /WEB-INF/builder-data.xml
          /WEB-INF/builder-security.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;builder&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;2&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;builder&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.htm&lt;/url-pattern&gt;
      &lt;url-pattern&gt;*.docx&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;targetClass&lt;/param-name&gt;
          &lt;param-value&gt;org.springframework.security.web.FilterChainProxy&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;session-config&gt;
      &lt;session-timeout&gt;
          30
      &lt;/session-timeout&gt;
  &lt;/session-config&gt;
  &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;redirect.jsp&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>And here is my builder-security (mind the disorganization):</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:s="http://www.springframework.org/schema/security"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.springframework.org/schema/beans
                          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                          http://www.springframework.org/schema/security
                          http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
  &lt;!--&lt;s:authentication-manager&gt;
      &lt;s:authentication-provider ref="authenticationProvider"/&gt;
  &lt;/s:authentication-manager&gt;--&gt;
  
  &lt;bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;s:filter-chain-map path-type="ant"&gt;
          &lt;s:filter-chain pattern="/**"
              filters="securityContextPersistenceFilter,
                      exceptionTranslationFilter,
                      authenticationProcessingFilter,
                      filterSecurityInterceptor,
                      anonymousAuthenticationFilter"/&gt;
      &lt;/s:filter-chain-map&gt;
  &lt;/bean&gt;
  
  &lt;bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"/&gt;
  
  &lt;bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
      &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationProcessingFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"&gt;
      &lt;property name="providers"&gt;
          &lt;list&gt;
              &lt;ref bean="authenticationProvider"/&gt;
              &lt;ref bean="anonymousAuthenticationProvider"/&gt;
          &lt;/list&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;!--&lt;property name="passwordEncoder" ref="md5PasswordEncoder"/&gt;--&gt;
      &lt;!--&lt;property name="saltSource" ref="systemWideSaltSource"/&gt;--&gt;
      &lt;property name="userDetailsService" ref="authenticationDao"/&gt;
      &lt;property name="userCache" ref="userCache"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="md5PasswordEncoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"&gt;
  
  &lt;/bean&gt;
  
  &lt;bean id="systemWideSaltSource" class="org.springframework.security.authentication.dao.SystemWideSaltSource"&gt;
      &lt;property name="systemWideSalt" value="XXXX"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="userCache" class="org.springframework.security.core.userdetails.cache.EhCacheBasedUserCache"&gt;
      &lt;property name="cache" ref="ehcache"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="ehcache" class="org.springframework.cache.ehcache.EhCacheFactoryBean"&gt;
      &lt;property name="cacheManager" ref="cacheManager"/&gt;
      &lt;property name="cacheName" value="userCache"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"&gt;
      &lt;property name="configLocation" value="ehcache.xml"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationDao" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl"&gt;
      &lt;property name="dataSource" ref="dataSource"/&gt;
  &lt;/bean&gt;
  
  &lt;!--&lt;bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="SpecBuilder"/&gt;
  &lt;/bean&gt;--&gt;
  &lt;bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
      &lt;property name="loginFormUrl" value="/login.html"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"&gt;
      &lt;property name="decisionVoters"&gt;
          &lt;list&gt;
              &lt;ref bean="voter"/&gt;
          &lt;/list&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="voter" class="org.springframework.security.access.vote.RoleVoter"&gt;
      &lt;property name="rolePrefix" value="ROLE_"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="anonymousAuthenticationFilter" class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter"&gt;
      &lt;property name="key" value="foobar"/&gt;
      &lt;property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="anonymousAuthenticationProvider" class="org.springframework.security.authentication.AnonymousAuthenticationProvider"&gt;
      &lt;property name="key" value="foobar"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="accessDecisionManager" ref="accessDecisionManager"/&gt;
      &lt;property name="objectDefinitionSource"&gt;
          &lt;s:filter-invocation-definition-source&gt;
              &lt;s:intercept-url pattern="/login*" access="ROLE_ANONYMOUS"/&gt;
              &lt;s:intercept-url pattern="/**" access="ROLE_USER"/&gt; &lt;!-- isAuthenticated() probably better --&gt;
          &lt;/s:filter-invocation-definition-source&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>Right now I am trying to get login.html to all anonymous access, yet all I get is an infinite security loop.</p>
  
  <p>Is there a reason I shouldn't be using bean declarations for this? Because not very many people seem to be doing so. I'd rather not change the whole thing if there is no advantage to doing it. There has to be something wrong with it or a better place to go to get bean declaration references and examples, because most all searches turn up the other style of implementing spring security.</p>