What's the difference between 'configure' and 'configureGlobal' methods?

Question

I'm playing around with Spring Security configuration and find out, that the most common way to configure in-memory authentication is using configureGlobal() method:

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{
    auth
      .inMemoryAuthentication()
        .withUser("user").password("userPwd").roles("USER");
  }
}

But there is another way, which is less widely used, overriding configure() method from WebSecurityConfigurerAdapter:

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth
      .inMemoryAuthentication(
        .withUser("user").password("userPwd").roles("USER");
  }
}

I'm just wondering, what's the difference between them and what's the point of usage configureGlobal() method over configure() one?

Answer 1

This answer helped me.

Difference between registerGlobal(), configure(), configureGlobal(),configureGlobalSecurity in Spring security

If you already extend class like WebMvcConfiguratorAdapter, you have two choices for security settings.

1. Using configureGlobal() method:

   • Single @Configuration class approach.
   • You can set security while maintaining your config class.
   • SpringWebConfig extends WebMvcConfigurerAdapter + @EnableWebSecurity

2. Overriding configure() method:

   • Specific security @Configuration class.
   • You must create a new config class to extend WebSecurityConfiguratorAdapter for security setup.
   • MySecurityConfig extends WebSecurityConfigurerAdapter

Answer 2

As the spring security doc says:

The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either @EnableWebSecurity, @EnableGlobalMethodSecurity, or @EnableGlobalAuthentication. Doing otherwise has unpredictable results.