title: Spring Security Configuration Leads to Perpetual Authentication Request
body: <p>I have configured my web application with the following config file:</p>
  
  <pre><code> &lt;beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
  &lt;security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" /&gt;
  
  &lt;!--
      Filter chain; this is referred to from the web.xml file. Each filter
      is defined and configured as a bean later on.
  --&gt;
  &lt;!-- Note: anonumousProcessingFilter removed. --&gt;
  &lt;bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map path-type="ant"&gt;
          &lt;security:filter-chain pattern="/**"
              filters="securityContextPersistenceFilter,
                  basicAuthenticationFilter,
                  exceptionTranslationFilter,
                  filterSecurityInterceptor" /&gt;
      &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  
  &lt;!--
      This filter is responsible for session management, or rather the lack
      thereof.
  --&gt;
  &lt;bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"&gt;
      &lt;property name="securityContextRepository"&gt;
          &lt;bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"&gt;
              &lt;property name="allowSessionCreation" value="false" /&gt;
          &lt;/bean&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;!-- Basic authentication filter. --&gt;
  &lt;bean id="basicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint" /&gt;
  &lt;/bean&gt;
  
  &lt;!-- Basic authentication entry point. --&gt;
  &lt;bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint"&gt;
      &lt;property name="realmName" value="Ayudo Web Service" /&gt;
  &lt;/bean&gt;
  
  &lt;!--
      An anonymous authentication filter, which is chained after the normal authentication mechanisms and automatically adds an
      AnonymousAuthenticationToken to the SecurityContextHolder if there is no existing Authentication held there.
  --&gt;
  &lt;!--
      &lt;bean id="anonymousProcessingFilter" class="org.springframework.security.web.authentication.AnonymousProcessingFilter"&gt;
      &lt;property name="key" value="ayudo" /&gt; &lt;property name="userAttribute" value="anonymousUser, ROLE_ANONYMOUS" /&gt; &lt;/bean&gt;
  --&gt;
  
  &lt;!--
      Authentication manager that chains our main authentication provider
      and anonymous authentication provider.
  --&gt;
  &lt;bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"&gt;
      &lt;property name="providers"&gt;
          &lt;list&gt;
              &lt;ref local="daoAuthenticationProvider" /&gt;
              &lt;ref local="inMemoryAuthenticationProvider" /&gt;
              &lt;!-- &lt;ref local="anonymousAuthenticationProvider" /&gt; --&gt;
          &lt;/list&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;!--
      Main authentication provider; in this case, memory implementation.
  --&gt;
  &lt;bean id="inMemoryAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;property name="userDetailsService" ref="propertiesUserDetails" /&gt;
  &lt;/bean&gt;
  
  &lt;security:user-service id="propertiesUserDetails" properties="classpath:operators.properties" /&gt;
  
  &lt;!-- Main authentication provider. --&gt;
  &lt;bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;property name="userDetailsService" ref="userDetailsService" /&gt;
  &lt;/bean&gt;
  
  &lt;!--
      An anonymous authentication provider which is chained into the ProviderManager so that AnonymousAuthenticationTokens are
      accepted.
  --&gt;
  &lt;!--
      &lt;bean id="anonymousAuthenticationProvider" class="org.springframework.security.authentication.AnonymousAuthenticationProvider"&gt;
      &lt;property name="key" value="ayudo" /&gt; &lt;/bean&gt;
  --&gt;
  
  &lt;bean id="userDetailsService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl"&gt;
      &lt;property name="dataSource" ref="dataSource" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
      &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint" /&gt;
      &lt;property name="accessDeniedHandler"&gt;
          &lt;bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl" /&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"&gt;
      &lt;property name="securityMetadataSource"&gt;
          &lt;security:filter-security-metadata-source use-expressions="true"&gt;
              &lt;security:intercept-url pattern="/*.html" access="permitAll" /&gt;
              &lt;security:intercept-url pattern="/version" access="permitAll" /&gt;
              &lt;security:intercept-url pattern="/users/activate" access="permitAll" /&gt;
              &lt;security:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
          &lt;/security:filter-security-metadata-source&gt;
      &lt;/property&gt;
      &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;property name="accessDecisionManager" ref="accessDecisionManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"&gt;
      &lt;property name="decisionVoters"&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;bean class="org.springframework.security.web.access.expression.WebExpressionVoter" /&gt;
          &lt;/list&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p></p>
  
  <p>As soon as I run my application on tomcat, I get a request for username/password basic authentication dialog. Even when I try to access: localhost:8080/myapp/version, which is explicitly set to permitAll, I get the authentication request dialog. Help!</p>
  
  <p>Thank,
  Sammy</p>