Spring Security : check whether you have multiple ContextLoader* definitions in your web.xml!

Problem:

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
 public SecurityWebApplicationInitializer(){
 super(SpringSecurityWebConfig.class);
}
}

Trace:

java.lang.IllegalStateException: Cannot initialize context because there is already a root application context present - check whether you have multiple ContextLoader* definitions in your web.xml!

  at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:297)
  at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:107)
  at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:5014)
  at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5524)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
  at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
  at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
  at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:649)
  at org.apache.catalina.startup.HostConfig.manageApp(HostConfig.java:1760)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:301)
  at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(Unknown Source)
  at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(Unknown Source)
  at org.apache.catalina.mbeans.MBeanFactory.createStandardContext(MBeanFactory.java:618)
  at org.apache.catalina.mbeans.MBeanFactory.createStandardContext(MBeanFactory.java:565)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:301)
  at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(Unknown Source)
  at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(Unknown Source)
  at javax.management.remote.rmi.RMIConnectionImpl.doOperation(Unknown Source)
  at javax.management.remote.rmi.RMIConnectionImpl.access$300(Unknown Source)
  at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(Unknown Source)
  at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(Unknown Source)
  at javax.management.remote.rmi.RMIConnectionImpl.invoke(Unknown Source)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at sun.rmi.server.UnicastServerRef.dispatch(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.Transport.serviceCall(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport.handleMessages(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)

Solution:

If we were using Spring elsewhere in our application we probably already had a WebApplicationInitializer that is loading our Spring Configuration. If we use the previous configuration we would get an error. Instead, we should register Spring Security with the existing ApplicationContext. For example, if we were using Spring MVC our SecurityWebApplicationInitializer would look something like the following: (Remove constructor)

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
    
}

Rer : http://docs.spring.io/spring-security/site/docs/4.2.0.RELEASE/reference/htmlsingle/