I had the same issue.
I missed the spring security initializer and so springSecurityFilterChain
was not registered.
I added this class in my app, and then all security worked just fine
public class SecurityWebApplicationInitializer
extends AbstractSecurityWebApplicationInitializer {
}
And by the way, no web.xml required at all if you use annotation config.