Spring Security Configuration @Order not unique exception

Putting @Order(1000) on the second WebSecurityConfigurerAdapter worked for me

It is because Spring security uses [WebSecurityConfigurerAdapter][1] under the hood and this adaptor is using order(100), hence spring won't allow duplicate order sequence.


[1]:

[To see links please register here]

In my case, I had put the `@EnableOAuth2Sso` annotation on the class annotated with `@SpringBootApplication`, but I also had a separate class extending `WebSecurityConfigurerAdapter`. As the documentation of `@EnableOAuth2Sso` says:

> If there is an existing WebSecurityConfigurerAdapter provided by the user and annotated with @EnableOAuth2Sso, it is enhanced by adding an authentication filter and an authentication entry point. If the user only has @EnableOAuth2Sso but not on a WebSecurityConfigurerAdapter **then one is added** with all paths secured.

Since a default adapter was being added, I ended up with two, which caused the exception.
The solution was of course to move the `@EnableOAuth2Sso` annotation to the class which extended `WebSecurityConfigurerAdapter`.

In my case, I had 2 tags `@EnableWebSecurity` and
`@EnableGlobalMethodSecurity(securedEnabled = true)`. When I removed `@EnableWebSecurity` tag the problem got solved.

In my case, there was another security config class that is established in the parent project. I used excludeFilters tag to exclude the parent security config class and I add my config class spring directly use that config class.

@ComponentScan(basePackages = {
"com.example.parentProject", // this is the package that have securit config staff

},
excludeFilters = {@ComponentScan.Filter(
type = FilterType.ASSIGNABLE_TYPE,
value = {
SecurityConfig.class //which is inhareted from the parent package
})
})

public class SpringApp{
.....

}

All enabling features should be in main SpringApplication.run(Myclass.class, args);

In my case, I have ZuluConfiguration and KeyCloakConfiguration so I have enabled those configurations under the main class of springbootapplication annotation. it resolved my problem.


@SpringBootApplication
@EnableZuulProxy
@KeycloakConfiguration