Spring Security 3.2: JavaConfig springSecurityFilterChain setup in a Servlet <3.0 environment

spring-security

Solution

Spring Security 3.2 is configured in below code with JavaConfig in Servlet 2.5 environment.

web.xml

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private UserDetailsService userDetailsService;

@Override
protected void configure(AuthenticationManagerBuilder registry)
        throws Exception {
    registry.userDetailsService(userDetailsService).passwordEncoder(
            new BCryptPasswordEncoder());
}

@Override
public void configure(WebSecurity webSecurity) throws Exception {
    webSecurity.ignoring().antMatchers("/resources");
}

@Override
protected void configure(HttpSecurity http) throws Exception {

http.csrf().disable()
    .authorizeRequests()
        .antMatchers("/admin.htm")
        .hasAuthority("ROLE_ADMIN")
        .antMatchers("/personal/myPhotos.htm")
        .hasAnyAuthority("ROLE_USER", "ROLE_FAMILY", "ROLE_ADMIN")
        .antMatchers("/personal/familyPhotos.htm")
        .hasAnyAuthority("ROLE_FAMILY", "ROLE_ADMIN")
        .antMatchers("/**").permitAll()
        .anyRequest().authenticated()
    .and()
        .formLogin()
        .usernameParameter("j_username") // default is username
        .passwordParameter("j_password") // default is password
        .loginPage("/login.htm")
        .loginProcessingUrl("/j_spring_security_check")
        .failureUrl("/login.htm?login_error=t")
        .permitAll()
    .and()
        .logout().logoutSuccessUrl("/")
        .logoutUrl("/j_spring_security_logout")
    .and()
        .rememberMe().key("myAppKey").tokenValiditySeconds(864000);
}
}

There are some similarities and differences in javaconfig and xml configuration that are very well explained in this blog

Problem

I'm trying to setup Spring Security 3.2 with JavaConfig in a Servlet 2.5 environment. The reference (http://docs.spring.io/spring-security/site/docs/3.2.0.RELEASE/reference/htmlsingle/#jc) only covers the Servlet 3.0+ setup for the springSecurityFilterChain . Grateful for hints/links how to setup this filter-chain in a Servlet 2.5 environment the right way.

Original source