title: Where do I define `springSecurityFilterChain` bean?
body: <p>When I place the bean definition for <code>springSecurityFilterChain</code> in <code>web.xml</code>, I get an error indicating that Tomcat 7 will not start because there is a <code>duplicate bean definition for springSecurityFilterChain</code>. I uploaded the entire stack trace to a file sharing site, which you can read <a href="https://jumpshare.com/v/tAhRPP8f0zaWL2ZIl7AJ?b=BUQVBOzkVotcLCCJyvMe">by clicking on this link</a>.  However, when I the comment out the <code>springSecurityFilterChain</code> bean definition in <code>web.xml</code> and try to restart the server, I get a different error message indicating that there is no bean definition for <code>springSecurityFilterChain</code>. You can read the second stack trace at the file sharing site <a href="https://jumpshare.com/v/IRqM8WaHnScGh48Ep7AA?b=bwlcFwNI0kSNgqGNQeQN">by clicking on this link</a>.</p>
  
  <p><em>So where should I put the bean definition for <code>springSecurityFilterChain</code>, and what should its syntax be?</em></p>
  
  <p>I think the problem might be that the spring petclinic sample app, which I am using to test this approach, has its own way of using a <code>clinicservice</code> and its own xml config files to handle application startup and the management of resources.  You can view the entire code for the spring petclinic app <a href="https://github.com/spring-projects/spring-petclinic/">at this link</a>.  </p>
  
  <p><em>The changes I made to the petclinic app are as follows:</em></p>
  
  <p>I added the following to pom.xml:  </p>
  
  <pre><code>&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
    &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
    &lt;version&gt;3.2.2.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  
  &lt;dependency&gt;
    &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
    &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
    &lt;version&gt;3.2.2.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
    &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
    &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
    &lt;version&gt;3.2.2.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;  
  </code></pre>
  
  <p>I added the following to web.xml:  </p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
    &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>I added a package named <code>org.springframework.security.samples.knowledgemanager.config</code> to <code>src/main/java</code> in <code>Java Resources</code>, and then I added the following two classes to it:  </p>
  
  <p>MessageSecurityWebApplicationInitializer.java:  </p>
  
  <pre><code>@Order(2)
  public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {}  
  </code></pre>
  
  <p>SecurityConfig.java:  </p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private DataSource dataSource;
  
      @Autowired
      private UserDetailsService myCustomUserDetailsService;
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth
          .jdbcAuthentication()
              .dataSource(dataSource)
              .and()
          .userDetailsService(myCustomUserDetailsService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
          .authorizeRequests()
              .antMatchers("/app/**").hasRole("ADMIN")
              .and()
          .formLogin()
              .loginPage("/index.jsp")
              .defaultSuccessUrl("/app/")
              .failureUrl("/index.jsp")
              .permitAll()
              .and()
          .logout()
              .logoutSuccessUrl("/index.jsp");
      }
  }
  </code></pre>