How to implement Spring Security 4 with both XML and Java config -

i trying implement spring-security 4 spring mvc web , rest app. added 2 classes enable spring security java config way. still want hold onto web.xml , not change entire project use java config. that, following error:

29-may-2015 08:47:12.826 severe [localhost-startstop-1]   org.apache.catalina.core.standardcontext.filterstart exception starting    filter springsecurityfilterchain org.springframework.beans.factory.nosuchbeandefinitionexception: no bean    named 'springsecurityfilterchain' defined @ org.springframework.beans.factory.support.defaultlistablebeanfactory. getbeandefinition(defaultlistablebeanfactory.java:687) 

as can see, says springsecurityfilterchain cannot recognized. of course supposed enabled @enablewebsecurity see below:

classes used spring security:

@configuration @enablewebsecurity public class securityconfig extends websecurityconfigureradapter {  @autowired public void configureglobal(authenticationmanagerbuilder auth) throws exception {   auth.inmemoryauthentication().withuser("abc").password("123456").roles("user");   auth.inmemoryauthentication().withuser("admin").password("123456").roles("admin");   auth.inmemoryauthentication().withuser("dba").password("123456").roles("dba"); }  @override protected void configure(httpsecurity http) throws exception {    http.authorizerequests()     .antmatchers("/admin/**").access("hasrole('role_admin')")     .antmatchers("/dba/**").access("hasrole('role_admin') or hasrole('role_dba')")     .and().formlogin();      } }  public class springsecurityinitializer extends abstractsecuritywebapplicationinitializer {    //do nothing } 

the weird thing if add springsecurityfilterchain web.xml, @ runtime complains , says there duplicate springsecurityfilterchain. noticed in java config, this:

public class mvcwebapplicationinitializer extends     abstractannotationconfigdispatcherservletinitializer {  @override protected class<?>[] getrootconfigclasses() {     return new class[] { securityconfig.class }; } 

where register securityconfig java config mvcwebapp. makes part of servlet context believe.

all in all, how can have springsecurityfilterchain recognized? need register securityconfig class in web.xml or existing application context?

i think may first problem area:

public class securitywebapplicationinitializer   extends abstractsecuritywebapplicationinitializer {  } 

the spring docs say:

instead, should register spring security existing applicationcontext. example, if using spring mvc our securitywebapplicationinitializer.

can mean in case, can take securityconfig , should make bean? or not bean because dicoverable through @configuration?

how can make securityconfig recognized via xml while using new java config well?

assuming want spring security java config working 2 classes securityconfig , securitywebapplicationinitializer, need following working. please note assuming spring mvc configuration still xml. please note com.mkyong.web.config package have securityconfigclass. ensure web context have security configuration available.

web.xml follows

<context-param>           <param-name>contextclass</param-name>           <param-value>               org.springframework.web.context.support.annotationconfigwebapplicationcontext           </param-value>       </context-param>       <context-param>           <param-name>contextconfiglocation</param-name>           <param-value>com.mkyong.web.config</param-value>       </context-param>     <listener>       <listener-class>org.springframework.web.context.contextloaderlistener</listener-class>   </listener>