@Configuration
@EnableWebMvcSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(tokenAP());
        auth.authenticationProvider(usernameAndPasswordAP());
        auth.userDetailsService(getUserDetailsService());
    }

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  auth.authenticationProvider(tokenAP())
    .authenticationProvider(usernameAndPasswordAP())
    .userDetailsService(getUserDetailsService());
}

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)