title: Spring Security: Allow page views for all Fully Authenticated users, unless they have a specific role
body: <p>I'm using Spring 3.0.3 with Spring Security.</p>
  
  <p>So, I have fairly lenient restrictions on an app I'm making. I only want to make sure that a person can log in and be authenticated in order to view the app. I don't want to grant roles to every potential user of this app (could be in the 10s of thousands).</p>
  
  <p>So, it's been fine to use:</p>
  
  <pre><code>&lt;security:intercept-url pattern="/**" access="isFullyAuthenticated()" requires-channel="https"/&gt;
  </code></pre>
  
  <p>But now I want to be able to restrict people from using the app if I need to, so I created a role called ROLE_BANNED in the hopes that I could just assign roles to those people being problems.</p>
  
  <p>So, now I'm trying this:</p>
  
  <pre><code>&lt;security:intercept-url pattern="/**" access="isFullyAuthenticated() and not hasRole('ROLE_BANNED')" requires-channel="https"/&gt;
  </code></pre>
  
  <p>This seemed to work at first, but it can't load my denied page. I believe that it is restricting access to the denied page. I can't load the denied page through the controller or as a jsp in WEB-INF.</p>
  
  <p>Can someone show me how to allow authenticated users to access all of my app and send people with a specific role (ROLE_BANNED) to the denied page?</p>
  
  <p><strong>EDIT</strong>
  Here is my whole security:http setup:</p>
  
  <pre><code>&lt;security:http auto-config="true" access-denied-page="/denied" entry-point-ref="casAuthenticationEntryPoint" use-expressions="true"&gt;
      &lt;security:intercept-url pattern="/**" access="isFullyAuthenticated() and not hasRole('ROLE_BANNED')" requires-channel="https"/&gt;
      &lt;security:intercept-url pattern="/denied" access="IS_AUTHENTICATED_FULLY" filters="none" /&gt;
  
      &lt;security:logout logout-url="/logout" logout-success-url="${cas.logoutUrl}" /&gt;
      &lt;security:session-management session-fixation-protection="none" /&gt;
      &lt;security:custom-filter after="CAS_FILTER" ref="casAuthenticationFilter"/&gt;
      &lt;security:custom-filter before="CHANNEL_FILTER" ref="channelProcessingFilter" /&gt;
      &lt;security:port-mappings&gt;
          &lt;security:port-mapping http="80" https="443" /&gt;
      &lt;/security:port-mappings&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>I have tried using a controller mapped denied page (/denied), a jsp page (/denied.jsp) and even a simple html page (/denied.html), but I get a 404 for every single one. I don't see anything in the log files when this occurs.</p>