title: Spring Security - GrantedAuthority and role-based access
body: <p>I'm using a custom UserDetailService which works fine for authentication. The problem is that I can't use role-based constraints. </p>
  
  <p>It's odd that I get the correct authorities from the Controller:</p>
  
  <pre><code>public ModelAndView getMembers(HttpServletRequest request, Authentication auth) 
  {
     if(auth != null)
     {
        for (GrantedAuthority ga : auth.getAuthorities())
        {
           // works find and logs "ADMIN", btw. I'm using SimpleGrantedAuthority
           this.logger.debug("0{}", ga);
        }
     }
  }
  </code></pre>
  
  <p>But with the configuration</p>
  
  <pre><code>http
     .csrf().disable()
     .authorizeRequests()
     .antMatchers("/Admin/**").hasRole("ADMIN")
     …
  </code></pre>
  
  <p>The user can't access pages at e.g. /Admin/Member.</p>
  
  <p>Same goes for thymeleaf-security-tags, e.g. </p>
  
  <pre><code>&lt;div sec:authorize="isAuthenticated() &amp;&amp; hasRole('ADMIN')"&gt;Hello Admin!&lt;/div&gt;
  </code></pre>
  
  <p>doesn't show "Hello Admin!" for users where the Controller logs authority "ADMIN".</p>
  
  <p>I'm guess I'm missing something or using something wrong.</p>
  
  <p>Thanks for your time and help. </p>