title: Spring Security 3.2.1 Multiple login forms with distinct WebSecurityConfigurerAdapters
body: <p>I'm using Spring Security 3.2.1.RELEASE with Spring MVC 4.0.4.RELEASE </p>
  
  <p>I'm trying to setup Spring Security for a web application that will have two distinct login entry pages.  I need the pages to be distinct as they will be styled and accessed differently. </p>
  
  <p>First login page is for Admin users and protects admin pages /admin/** </p>
  
  <p>Second login page is for Customer users and protects customer pages /customer/**.</p>
  
  <p>I've attempted to setup two subclasses of WebSecurityConfigurerAdapter configuring individual HttpSecurity objects.</p>
  
  <p>CustomerFormLoginWebSecurity is protecting customer pages and redirecting to customer login page if not authorised. 
  The AdminFormLoginWebSecurity is protecting admin pages redirecting to admin login page if not authorised.</p>
  
  <p>Unfortunately it seems that only the first of the configurations is enforced.  I think that I am missing something extra to make these both work.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig {
  
      @Autowired
      public void registerGlobalAuthentication(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .inMemoryAuthentication()
                  .withUser("customer").password("password").roles("CUSTOMER").and()
                  .withUser("admin").password("password").roles("ADMIN");
      }
  
      @Configuration
      @Order(1)
      public static class CustomerFormLoginWebSecurity extends WebSecurityConfigurerAdapter {
  
          @Override
          public void configure(WebSecurity web) throws Exception {
              web
                      .ignoring()
                      .antMatchers("/", "/signin/**", "/error/**", "/templates/**", "/resources/**", "/webjars/**");
          }
  
          protected void configure(HttpSecurity http) throws Exception {
              http
                      .csrf().disable()
                      .authorizeRequests()
                      .antMatchers("/customer/**").hasRole("CUSTOMER")
                      .and()
                      .formLogin()
                      .loginPage("/customer_signin")
                      .failureUrl("/customer_signin?error=1")
                      .defaultSuccessUrl("/customer/home")
                      .loginProcessingUrl("/j_spring_security_check")
                      .usernameParameter("j_username").passwordParameter("j_password")
                      .and()
                      .logout()
                      .permitAll();
  
              http.exceptionHandling().accessDeniedPage("/customer_signin");
          }
      }
  
      @Configuration
      public static class AdminFormLoginWebSecurity extends WebSecurityConfigurerAdapter {
          @Override
          public void configure(WebSecurity web) throws Exception {
              web
                      .ignoring()
                      .antMatchers("/", "/signin/**", "/error/**", "/templates/**", "/resources/**", "/webjars/**");
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                      .csrf().disable()
                      .authorizeRequests()
                      .antMatchers("/admin/**").hasRole("ADMIN")
                      .and()
                      .formLogin()
                      .loginPage("/admin_signin")
                      .failureUrl("/admin_signin?error=1")
                      .defaultSuccessUrl("/admin/home")
                      .loginProcessingUrl("/j_spring_security_check")
                      .usernameParameter("j_username").passwordParameter("j_password")
                      .and()
                      .logout()
                      .permitAll();
  
              http.exceptionHandling().accessDeniedPage("/admin_signin");
          }
      }
  
  }
  </code></pre>