title: Spring webflow overwrite Spring security request rules?
body: <p>Project use SWF 2.4.1 and SSec 4. I specified a failUrl on spring security for errors on login and a transition on webflow if evaluate expression fail. In this case SWF redirection is priority to SSec redirection. I wonder if there is some way to omit/change this behavior because I would follow spring security rules automatically without to create rules on spring webflow.</p>
  
  <p><strong>security rules</strong></p>
  
  <pre><code>http
      .antMatcher("/spring/**/*.xhtml")
          .exceptionHandling().authenticationEntryPoint(new AccessDenyEntryPoint())
      .and()
          .requestCache().requestCache(requestCache())
      .and()
      .authorizeRequests()
          .antMatchers("/spring/resources/**","/spring/login","/spring/signup",
                  "/spring/main","/spring/error","/spring/group").permitAll()
          .antMatchers("/spring/myprofile").hasRole("USER")
          .antMatchers("/spring/profilegroup").hasRole("MEMBER")
          .antMatchers("/spring/admin").hasRole("ADMIN")
          .antMatchers("/spring/**/*.xhtml").denyAll()
          .anyRequest().authenticated()
      .and()       
      .formLogin()
          .loginPage("/spring/login")
          .defaultSuccessUrl("/spring/main",true)
          .failureUrl("/spring/login?login_error=1")
      .and()
      .logout()
          .logoutSuccessUrl("/spring/home")
          .deleteCookies("JSESSIONID")
      .and()
          .rememberMe().userDetailsService(customDetailsService)
      .and()
      .exceptionHandling().accessDeniedPage("/spring/error?error_code=1")
      .and()
  
  
      // Disable CSRF (won't work with JSF) but ensure last HTTP POST request is saved
      // See https://jira.springsource.org/browse/SEC-2498
  
      .csrf().disable()
      .requestCache()
          .requestCache(new HttpSessionRequestCache())
       .and()
       .sessionManagement()
          .sessionFixation().changeSessionId()
          .invalidSessionUrl("/spring/main")
          .sessionAuthenticationErrorUrl("/spring/error?error_code=4")
          .maximumSessions(1)
          .expiredUrl("/spring/error?error_code=2")
          .maxSessionsPreventsLogin(true);
  </code></pre>
  
  <p><strong>Webflow rules</strong></p>
  
  <pre><code>    &lt;view-state id="login" view="login.xhtml"&gt;
      &lt;transition on="entry" to="connect"/&gt;
      &lt;transition on="recoveryPass" to="recovery" /&gt;
  &lt;/view-state&gt;
  
  &lt;action-state id="connect"&gt;
      &lt;evaluate expression="login.connect()" /&gt;
      &lt;transition on="yes" to="connected" /&gt;
      &lt;transition on="no" to="recovery" /&gt;
  &lt;/action-state&gt;
  
  &lt;view-state id="recovery" view="recovery.xhtml"&gt;
  
      &lt;transition on="sendPass" to="login" /&gt;
      &lt;transition on="return" to="login" /&gt;
      &lt;transition on="error" /&gt;
  &lt;/view-state&gt;
  
  &lt;end-state id="finish" /&gt;
  </code></pre>
  
  <p><strong>validation code</strong></p>
  
  <pre><code>public String connect(){
      logger.entry("Login.connect()");
  
      try{
          Authentication request=new UsernamePasswordAuthenticationToken(getEmail(), getPassword());
          Authentication result=daoProvider.authenticate(request);
          SecurityContextHolder.getContext().setAuthentication(result);
      }catch (BadCredentialsException e) {
          //MessageRedirect.addFlashMesage("usuario.no.registrado","msg");
          return "no";
      }catch (LockedException e) {
          //MessageRedirect.addFlashMesage("usuario.bloqueado","msg");
          return "no";
      }catch (DisabledException e) {
          //MessageRedirect.addFlashMesage("usuario.desactivado","msg");
          return "no";
      }
  
      return "yes";
  }
  </code></pre>