title: spring security using a custom permissionEvaluator for use in authorize tag with accesscontrollist
body: <p>I am having issues while trying to inject custom permission evaluator in spring security:</p>
  
  <p>My front-end code looks like this:</p>
  
  <pre><code>&lt;sec:accesscontrollist hasPermission="VIEW_HEADER,VIEW_ANYTHING" domainObject="${userWebsiteLocationContext}" &gt;
      &lt;b&gt;This is a TEST&lt;/b&gt;
  &lt;/sec:accesscontrollist&gt;
  </code></pre>
  
  <p>and I am trying the following within my spring security config :
      
          ...
          
      </p>
  
  <pre><code>...
  &lt;security:global-method-security&gt;
      &lt;security:expression-handler ref="expressionHandler"/&gt;
  &lt;/security:global-method-security&gt;
  
  &lt;bean id="permissionEvaluator" class="org.atd.storefront.security.impl.DefaultPermissionsEvaluator" &gt;
  &lt;/bean&gt;
  
  &lt;bean id="defaultExpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler" &gt;
      &lt;property name="permissionEvaluator" ref="permissionEvaluator" &gt;&lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>my custom permission evaulator simply returns false but the text is always displayed. I've also tried the solution at <a href="https://jira.springsource.org/browse/SEC-1749" rel="nofollow">https://jira.springsource.org/browse/SEC-1749</a> and tried to use the custom defined decision manager bean: access-decision-manager-ref="webAccessDecisionManager" with no avail. </p>
  
  <p>I don't get any exceptions, the hasPermission of my custom permissionevaluator just isn't called. </p>