Question

When Spring deals with configuration filenames, there are some defaults…

• When registering a DispatcherServlet in my web.xml, Spring looks up by default for a file named <servletname>-servlet.xml
• When registering a ContextLoadListener in my web.xml, Spring looks up by default for a file names applicationContext.xml

Therefore I ask: When I am using Spring Security, does Spring looks up a default filename? Or do I always have to configure it manually through <context-param> <param-name> contextConfigLocation </param-name>filename</param-value></context-param>…???

Answer 1

Spring Security doesn’t have its own application context, it uses the one created by ContextLoaderListener (i.e. applicationContext.xml).

So, you should put your Spring Security configuration into applicationContext.xml, or, if you want to put into separate file, you need to import that file from applicationContext.xml:

<import resource = "security.xml" />

or declare it in addition to applicationContext.xml in contextConfigLocatoion <context-param>:

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>applicationContext.xml, security.xml</param-value>
</context-param>