java - Spring security authentication manager unresolvable circular reference -

i'm using spring security 3.2.5. have 2 authentication providers. have problem unresolvable circular reference. first security.xml:

<security:http use-expressions="true" auto-config="false"     entry-point-ref="loginurlauthenticationentrypoint">     <security:intercept-url pattern="/**" access="permitall"         method="options" />         <security:intercept-url pattern="/user/login"         access="permitall" />     <security:intercept-url pattern="/**"     access="isauthenticated()" />  <security:custom-filter position="form_login_filter"     ref="twofactorauthenticationfilter" />   <security:logout logout-url="/user/logout"     logout-success-url="/demo/user/logoutsuccess" />  <security:session-management     session-authentication-strategy-ref="sas" />  </security:http>  <bean id="sas"     class="org.springframework.security.web.authentication.session.sessionfixationprotectionstrategy">     <property name="migratesessionattributes" value="false" /> </bean>  <bean id="sessionregistry"     class="org.springframework.security.core.session.sessionregistryimpl" />  <bean id="loginurlauthenticationentrypoint"     class="org.springframework.security.web.authentication.loginurlauthenticationentrypoint">     <property name="loginformurl" value="/demo/user/login" /> </bean>  <bean id="twofactorauthenticationfilter" class="com.xxx.filter.twofactorauthenticationfilter">     <property name="authenticationmanager" ref="authenticationmanager" />     <property name="authenticationfailurehandler" ref="failurehandler" />     <property name="authenticationsuccesshandler" ref="userauthenticationsuccesshandler" />     <property name="postonly" value="true" /> </bean>   <bean id="failurehandler"     class="org.springframework.security.web.authentication.simpleurlauthenticationfailurehandler">     <property name="defaultfailureurl" value="/login?login_error=true" />  </bean>  <bean id="bcryptpasswordencoder"     class="org.springframework.security.crypto.bcrypt.bcryptpasswordencoder" />  <security:authentication-manager alias="authenticationmanager">     <security:authentication-provider         ref="authenticationprovider">     </security:authentication-provider>     <security:authentication-provider         ref="restauthenticationprovider">     </security:authentication-provider> </security:authentication-manager> 

rest-security-context.xml:

<security:http create-session="stateless"         entry-point-ref="digestentrypoint" pattern="/provider/**"         use-expressions="true">         <security:intercept-url pattern="/provider/**"             access="isauthenticated()" />           <security:http-basic />         <security:custom-filter ref="digestfilter"             after="basic_auth_filter" />     </security:http>      <bean id="digestfilter"         class="org.springframework.security.web.authentication.www.digestauthenticationfilter">         <property name="userdetailsservice" ref="customerdetailsserviceimpl" />         <property name="authenticationentrypoint" ref="digestentrypoint" />     </bean>      <bean id="digestentrypoint"         class="org.springframework.security.web.authentication.www.digestauthenticationentrypoint">         <property name="realmname" value="contacts realm via digest authentication" />         <property name="key" value="acegi" />     </bean> 

in application.xml order is:

<import resource="/rest-security-context.xml" /> <import resource="/security.xml" /> 

i error:

 org.springframework.beans.factory.beancurrentlyincreationexception: error creating bean name 'org.springframework.security.authenticationmanager': requested bean in creation: there unresolvable circular reference? 

if change order in application context error:

a universal match pattern ('/**') defined  before other patterns in filter chain, causing them ignored. 

change order of files, , saw problem 2nd error :

you have :

// below url says, urls must permitted  <security:intercept-url pattern="/**" access="permitall"         method="options" />         <security:intercept-url pattern="/user/login"         access="permitall" /> // below line says, urls must authenticated, how possible without reaching authentication page. remove below     <security:intercept-url pattern="/**"     access="isauthenticated()" /> 

so should :

// wouldnt recomment below url permit /** all, not good.      <security:intercept-url pattern="/**" access="permitall"             method="options" />             <security:intercept-url pattern="/user/login"             access="permitall" />  

this guess. try out. let me know if works, or delete answer.