We have a Spring MVC application based on spring 5.x, also uses spring-security 5.x. The beans and the security filter chains along with patterns are configured by XML.
We are migrating to Spring 6 and intend to use spring-authorization-server for OAuth2 which only supports Java based configuration for configuring the authorization server securityFilterChain.
But when I add the new Java based config, it doesn't get picked neither the beans are created. I have to explicitly include it as a bean in xml config file to get it picked. But as soon as I do that, seems like it creates 2 securityFilterChain object and other bean creation are messed up.
I referred this issue and tried to implement what was suggested in the solution but I get an error :
Caused by: org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:121)
at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration.aggregateSpringSecurityFilterChain(AggregateSpringSecurityConfiguration.java:22)
at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration$$SpringCGLIB$$0.CGLIB$aggregateSpringSecurityFilterChain$0(<generated>)
at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:348)
at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration$$SpringCGLIB$$0.aggregateSpringSecurityFilterChain(<generated>)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:146)
Is there an efficient way where I can include Java based security configuration into xml based configuration.