From a366489c3c5d1b77966bea93dacd138243dac9af Mon Sep 17 00:00:00 2001
From: Wallace Wadge <wwadge@gmail.com>
Date: Sat, 5 Mar 2016 09:04:24 +0100
Subject: [PATCH] Sort ObjectPostProcessors prior to invoking them

Fixes gh-3572
---
 .../config/annotation/SecurityConfigurerAdapter.java   | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/config/src/main/java/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java b/config/src/main/java/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java
index 6262955a20..f4bb69175b 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java
@@ -15,10 +15,12 @@
  */
 package org.springframework.security.config.annotation;
 
-import java.util.ArrayList;
-import java.util.List;
-
 import org.springframework.core.GenericTypeResolver;
+import org.springframework.core.annotation.AnnotationAwareOrderComparator;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
 
 /**
  * A base class for {@link SecurityConfigurer} that allows subclasses to only implement
@@ -27,6 +29,7 @@ import org.springframework.core.GenericTypeResolver;
  * that is being configured.
  *
  * @author Rob Winch
+ * @author Wallace Wadge
  *
  * @param <O> The Object being built by B
  * @param <B> The Builder that is building O and is configured by
@@ -112,6 +115,7 @@ public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
 
 		@SuppressWarnings({ "rawtypes", "unchecked" })
 		public Object postProcess(Object object) {
+			Collections.sort(postProcessors, AnnotationAwareOrderComparator.INSTANCE);
 			for (ObjectPostProcessor opp : postProcessors) {
 				Class<?> oppClass = opp.getClass();
 				Class<?> oppType = GenericTypeResolver.resolveTypeArgument(oppClass,