title: Enable Spring Security pre-post-annotations programmatically
body: <p>I have Spring WebMVC Application using <code>@PreAuthorize</code> and <code>@PostAuthorice</code> annotations on the controller-methods. But these annotations are ignored since I don't have enabled it in my spring security.</p>
  
  <p>If I would have a <code>spring-security.xml</code> I could enable it with the following line:</p>
  
  <pre><code>&lt;global-method-security pre-post-annotations="enabled" /&gt;
  </code></pre>
  
  <p>Unfortunately I have a complete Annotation-based configuration.
  Spring-Security in principle works in my Application.</p>
  
  <p>My question: <strong>How can I enable pre-post-annotation with an annotation based MVC configuration?</strong></p>
  
  <ul>
  <li>Spring-Version: 4.0.5.RELEASE</li>
  <li>Spring-Security-Version: 3.2.4.RELEASE</li>
  </ul>
  
  <p>This is my <code>WebSecurityConfigurerAdapter</code> implementation:</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity()
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired DataSource dataSource;
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.jdbcAuthentication()
              .dataSource(dataSource)
              .passwordEncoder(new ShaPasswordEncoder(256))
              .usersByUsernameQuery("select username,password, enabled from user where USERNAME=?")
              .authoritiesByUsernameQuery("select u.username, r.name from user u, role r, user_has_role uhr where u.id = uhr.user_id and r.id = uhr.role_id and u.username = ?  ");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/resources/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .defaultSuccessUrl("/", true)
                  .and()
              .logout()
                  //.logoutUrl("/logout") //this is the default
                  // Call the URL invalidate_session after logout...
                  .logoutSuccessUrl("/invalidate_session")
                  .permitAll()
                  .and()
                 // @see http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#csrf-configure
              .csrf().disable();
      }
  }
  </code></pre>
  
  <p>My <code>MessageSecurityWebApplicationInitializer</code> is empty:</p>
  
  <pre><code>public class MessageSecurityWebApplicationInitializer extends
          AbstractSecurityWebApplicationInitializer {
  
  }
  </code></pre>