title: Spring Security, Method Security annotation (@Secured ) is not working (java config)
body: <p>I am trying to set up a method security annotation using @Secured("ADMIN") (without any XML, only java config, Spring Boot). But access via roles does not work.</p>
  
  <p>Security Config:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class AppSecurityConfiguration extends WebSecurityConfigurerAdapter{
  
  .....
  
  @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
                  .authorizeRequests()
                  .antMatchers("/api/**").fullyAuthenticated().and()
                  .addFilterBefore(tokenAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
      }
  
  .....
  
  }
  </code></pre>
  
  <p>I want restrict access to the method of the controller:</p>
  
  <pre><code>@RestController
  @RequestMapping("/api/groups")
  public class GroupController {
  
      @Autowired
      private GroupService groupService;
  
      @Secured("ADMIN")
      @RequestMapping
      public List&lt;Group&gt; list() {
          return groupService.findAll();
      }
  
  }
  </code></pre>
  
  <p>Restrict access by the url is working, with:</p>
  
  <pre><code>.antMatchers("/api/**").hasAuthority("ADMIN")
  </code></pre>
  
  <p>Maybe I forgot to specify that I want restrict by roles?</p>
  
  <p><strong>UPD:</strong>
  By the rules, At what layer must be <code>@PreAuthorize("hasRole('ADMIN')")</code> in Controller layer or in Service layer?</p>