title: Different filters for different url patterns
body: <p>I have a spring boot application that provides mainly REST endpoints, authentication is done via token (sent in <code>Authorization</code> header) where I have my own <code>TokenAuthenticationFilter</code> added before <code>LogoutFilter</code> to set the security context.</p>
  
  <p>In the process of creating an admin console, I want admin authentication to be separate from regular users, as I'm not sharing tables between <code>Admins</code> and <code>Users</code> for several reasons, on the database level I have the following <code>user,user_token,admin,admin_token</code>. So in order to accomplish this, I thought of several solutions:</p>
  
  <ol>
  <li>Let the current <code>TokenAuthenticationFilter</code> handle user/admin token
  auth. This however will require to either: Modify the filter to
  determine whether it's an admin or a user token based on url pattern
  (so for example if it's <code>/admin/**</code>, the filter will know which
  service to call) <strong>or</strong> have the admins header unique from the users
  (i.e. User sends U-Auth header, Admin sends A-Auth header) and the filter will act based on header name. This all
  doesn't sound good to me.</li>
  <li>Specify a set of filters to apply per url pattern, for example
  <code>/admin/**</code> will have <code>AdminTokenAuthFilter</code> added to the chain,
  while any other pattern will have the old
  <code>TokenAuthenticationFilter</code> in the chain. This sounds better than
  the earlier approach but I'm having trouble to implement it. I tried
  to register my own <code>FilterRegistrationBean</code> inside my <code>WebSecurityConfigurerAdapter</code></li>
  </ol>
  
  <p>Example:</p>
  
  <pre><code> @Bean
   public FilterRegistrationBean adminFilter(){
       FilterRegistrationBean filterRegBean = new FilterRegistrationBean();
       filterRegBean.setFilter(new AdminTokenAuthFilter());
       List&lt;String&gt; urlPatterns = new ArrayList&lt;&gt;();
       urlPatterns.add("/admin/*");
       filterRegBean.setUrlPatterns(urlPatterns);
       return filterRegBean;
   }
  </code></pre>
  
  <p>This seems to work but I'm unsure if it's proper practice also I'm concerned about one thing, I found that this adds the filter to the springs <code>originalChain</code> of filters, not to the <code>additionalFilters</code> that seems to apply when adding filters regularly in my <code>WebSecurityConfigurerAdapter</code> using  <code>http.addFilterBefore(tokenAuthenticationFilter, LogoutFilter.class)</code>. I don't want to alter springs original filter chain, i'd rather have my custom filters in the additional filter chain. Can anyone elaborate on this please?</p>
  
  <ol start="3">
  <li>Create two separate dispatcher servlets and make each one listen to
  a specific url pattern and I suppose each <code>dispatcherServlet</code> will have its own security configuration.</li>
  </ol>
  
  <p>Can anybody share some knowledge on what's the best approach in such a scenario?</p>