title: Missing ROLE_ANONYMOUS in Spring Security
body: <p>I have been using Spring Security 2.x for some time now, but recently I switched to 3.x. I always use my own implementation of <code>UserDetails</code> interface and authentication against DB.</p>
  
  <p>Everything works fine (logging in, logging out, url filters, seeing username of authorized user, etc.).</p>
  
  <p>The only thing left to do was to display "Please login" message when user is not authorized. I tried few approaches:</p>
  
  <pre><code>&lt;sec:authorize access="not isAnonymous()"&gt;
  or
  &lt;sec:authorize access="hasRole('ROLE_ANONYMOUS')"&gt;
  etc.
  </code></pre>
  
  <p>None of them worked. Finally I added <code>&lt;sec:authentication property="principal.authorities" /&gt;</code> to my home page output to debug what roles user really has. This is what I see:</p>
  
  <ul>
  <li>Logged user - <code>[ROLE_USER, ROLE_ADMIN]</code></li>
  <li>Unathorized user - `` &lt;- empty String</li>
  </ul>
  
  <p>It looks like I somehow lost the default <code>ROLE_ANONYMOUS</code> authority, which was always added by Spring, if I recall correctly. Was that recently dropped or something? Perhaps I have to take care of this anonymous access in some other manner?</p>
  
  <p>Relevant part of security context:</p>
  
  <pre><code>&lt;beans:beans
          xmlns="http://www.springframework.org/schema/security"
          xmlns:beans="http://www.springframework.org/schema/beans"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://www.springframework.org/schema/beans
             http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
             http://www.springframework.org/schema/security
             http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
      &lt;!-- UNPROTECTED RESOURCES --&gt;
      &lt;http pattern="/" security="none"/&gt;
      &lt;http pattern="/favicon.ico" security="none"/&gt;
      &lt;http pattern="/home" security="none"/&gt;
      &lt;http pattern="/login*" security="none"/&gt;
      &lt;http pattern="/resources/**" security="none"/&gt;
  
      &lt;!-- PROTECTED RESOURCES --&gt;
      &lt;http auto-config='true' use-expressions="true"&gt;
          &lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')"/&gt;
          &lt;intercept-url pattern="/admin/**" access="hasRole('ROLE_USER,ROLE_ADMIN')"/&gt;
          &lt;form-login login-page="/login" default-target-url="/dashboard" authentication-failure-url="/login?login_error=true"/&gt;
          &lt;logout logout-url="/logout"/&gt;
      &lt;/http&gt;
  
      &lt;beans:bean id="userAccountsAuthenticationProvider" class="pl.xxx.utils.UserAccountsAuthenticationProvider" /&gt;
  
      &lt;beans:bean id="saltSource" class="org.springframework.security.authentication.dao.ReflectionSaltSource"&gt;
          &lt;beans:property name="userPropertyToUse" value="salt" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider user-service-ref="userAccountsAuthenticationProvider"&gt;
              &lt;password-encoder ref="standardPasswordEncoder"/&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>