title: Spring Security 4 and JSF 2 integration
body: <p>Is there a way to integrate Spring Security 4 (Mainly for managing user access levels and which views they can access) and JSF 2?</p>
  
  <p>I found <a href="https://github.com/stephanrauh/JSF-on-Spring-Boot/tree/master/PrimeFacesOnSpringBoot" rel="noreferrer">this neat thing</a> which allows you to mix both Spring Boot, and JSF 2 with PrimeFaces 5. Great stuff. I want to see if you can kick it up another level.</p>
  
  <p>Normally you would configure Spring Security for Spring MVC like so:</p>
  
  <p><strong>WebSecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .authorizeRequests()
                  .antMatchers("/", "/home").permitAll()
                  .anyRequest().authenticated()
  
                  .and()
  
                  .formLogin()
                  .loginPage("/login")
                  .permitAll()
  
                  .and()
  
                  .logout()
                  .permitAll();
      }
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .inMemoryAuthentication()
                  .withUser("Zyst").password("password").roles("USER");
      }
  }
  </code></pre>
  
  <p>And then those would as far as I know, do correct me if I'm mistaken, look in your MvcConfig to see what it actually means by "/home" and the like:</p>
  
  <p><strong>MvcConfig.java</strong></p>
  
  <pre><code>@Configuration
  public class MvcConfig extends WebMvcConfigurerAdapter {
  
      @Override
      public void addViewControllers(ViewControllerRegistry registry) {
          registry.addViewController("/home").setViewName("home");
          registry.addViewController("/").setViewName("home");
          registry.addViewController("/hello").setViewName("hello");
          registry.addViewController("/login").setViewName("login");
      }
  }
  </code></pre>
  
  <p>However, I've been googling for a few hours and cannot really find a conclusive answer how to configure Spring Security for JSF. Can you implement your front end using JSF and then make that managed by Spring Security, so, for example Links, ie: localhost:8080/home instead of localhost:8080/home.xhtml are properly managed and served? And so that user levels defined in <code>WebSecurityConfig.java</code> can only access pages relevant to themselves. </p>
  
  <p>From what I've (briefly) investigated it might not be possible due to Faces and Mvc being different technologies that don't particularly play well together. However, if possible I'd like to make sure of whether it's possible or not.</p>
  
  <p>And if it IS possible, can you provide either a working example, or a link to somewhere that goes more in depth? I did google quite a bit but it's 100% possible I ended up missing something.</p>
  
  <p>Any and all answers are greatly appreciated.</p>