Adding a new securityFilterChain using java config in an xml configured application doesn't work

[hellokkiyer]

We have a Spring MVC application based on spring 5.x, also uses spring-security 5.x. The beans and the security filter chains along with patterns are configured by XML.

We are migrating to Spring 6 and intend to use spring-authorization-server for OAuth2 which only supports Java based configuration for configuring the authorization server securityFilterChain.

But when I add the new Java based config, it doesn't get picked neither the beans are created. I have to explicitly include it as a bean in xml config file to get it picked. But as soon as I do that, seems like it creates 2 securityFilterChain object and other bean creation are messed up.

I referred this issue and tried to implement what was suggested in the solution but I get an error :

Caused by: org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
		at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41)
		at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:121)
		at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration.aggregateSpringSecurityFilterChain(AggregateSpringSecurityConfiguration.java:22)
		at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration$$SpringCGLIB$$0.CGLIB$aggregateSpringSecurityFilterChain$0(<generated>)
		at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
		at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
		at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:348)
		at com.test.abc.security.oauth2.config.AggregateSpringSecurityConfiguration$$SpringCGLIB$$0.aggregateSpringSecurityFilterChain(<generated>)
		at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
		at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
		at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
		at java.base/java.lang.reflect.Method.invoke(Method.java:569)
		at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:146)

Is there an efficient way where I can include Java based security configuration into xml based configuration.

[hellokkiyer]

Not sure, if it is a common usecase. But, there should be an option to integrate XML and Java based configuration together like Spring does allow configuring Beans in both way together