I had the same issue.
I missed the spring security initializer and so springSecurityFilterChain was not registered.

I added this class in my app, and then all security worked just fine

public class SecurityWebApplicationInitializer
        extends AbstractSecurityWebApplicationInitializer {
}

And by the way, no web.xml required at all if you use annotation config.