title: Spring Security Authorization Issue
body: <p>I am trying to authorize my rest service method for user or admin. But it seems it's not authorizing it and by passing the secured and preAuthorize tags. </p>
  
  <pre><code>    @Configuration
      @EnableWebSecurity
      @EnableGlobalMethodSecurity(securedEnabled = true,prePostEnabled = true, mode = org.springframework.context.annotation.AdviceMode.ASPECTJ, proxyTargetClass = true)
      public class UserDetailsSecurityConfig extends WebSecurityConfigurerAdapter {
  //Some Code Here
      }
  </code></pre>
  
  <p>My application config file:</p>
  
  <pre><code>@EnableWebMvc
  @Configuration
  @ComponentScan({ "com.ws.service.*" })
  @Import({ UserDetailsSecurityConfig.class })
  @javax.ws.rs.ApplicationPath("webresources")
  public class AppConfig extends Application {
   //Some Code Here
  }
  </code></pre>
  
  <p>My Rest service method:</p>
  
  <pre><code>    @GET
      @Secured("ROLE_ADMIN")
      @PreAuthorize("hasRole('ROLE_ADMIN')")
      @Path("getUser")
      @Produces({"application/xml", "application/json"})
      public User GetUser()  {
  
           User result;
          try{
               result = new User();
          }catch(NoResultException ne){
                result = null;
          }
          return result;
      }
  </code></pre>
  
  <p>Now either I sign in as admin user with ROLE_ADMIN or simple user with ROLE_USER. Spring Security authorize this method.</p>
  
  <p>I have changed my security logs to fine where it seems that preAuthorize annotation worked. But, in the end gets same result.</p>
  
  <pre><code>Finest:   Looking for Pre/Post annotations for method 'GetUser' on target class 'class com.ws.service.UserFacadeREST'
  Fine:   @org.springframework.security.access.prepost.PreAuthorize(value=hasRole('ROLE_ADMIN')) found on specific method: public com.ws.UpUser com.ws.service.UserFacadeREST.GetUser()
  Fine:   Caching method [CacheKey[com.ws.service.UserFacadeREST; public com.ws.User com.ws.service.UserFacadeREST.GetUser()]] with attributes [[authorize: 'hasRole('ROLE_ADMIN')', filter: 'null', filterTarget: 'null']]
  </code></pre>
  
  <p>When I try to log-in it logs me in successfully. I logged in from "user" who has "ROLE_USER" in database.</p>
  
  <pre><code>Fine:   /login at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  Fine:   /login at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  Fine:   HttpSession returned null object for SPRING_SECURITY_CONTEXT
  Fine:   No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@5094f334. A new one will be created.
  Fine:   /login at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  Fine:   Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@50da4786
  Fine:   /login at position 4 of 14 in additional filter chain; firing Filter: 'CsrfFilter'
  Fine:   /login at position 5 of 14 in additional filter chain; firing Filter: 'LogoutFilter'
  Fine:   Checking match of request : '/login'; against '/logout'
  Fine:   /login at position 6 of 14 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
  Fine:   Checking match of request : '/login'; against '/login'
  Fine:   Request is to process authentication
  Fine:   Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  Fine:   Delegating to org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy@72e0fc63
  Fine:   Delegating to org.springframework.security.web.csrf.CsrfAuthenticationStrategy@5c8272c1
  Fine:   Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@4428690f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: a50e5eecf72b5493c618ffbb20f0; Granted Authorities: ROLE_USER
  Fine:   Redirecting to DefaultSavedRequest Url: http://localhost:8080/LmsWebService/webresources/upuser/getUser
  Fine:   Redirecting to 'http://localhost:8080/LmsWebService/webresources/upuser/getUser'
  Fine:   SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@4428690f: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@4428690f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: a50e5eecf72b5493c618ffbb20f0; Granted Authorities: ROLE_USER'
  Fine:   SecurityContextHolder now cleared, as request processing completed
  Fine:   /webresources/upuser/getUser at position 1 of 14 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
  Fine:   /webresources/upuser/getUser at position 2 of 14 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
  Fine:   Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl@4428690f: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@4428690f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: a50e5eecf72b5493c618ffbb20f0; Granted Authorities: ROLE_USER'
  Fine:   /webresources/upuser/getUser at position 3 of 14 in additional filter chain; firing Filter: 'HeaderWriterFilter'
  Fine:   Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@50da4786
  Fine:   /webresources/upuser/getUser at position 4 of 14 in additional filter chain; firing Filter: 'CsrfFilter'
  Fine:   /webresources/upuser/getUser at position 5 of 14 in additional filter chain; firing Filter: 'LogoutFilter'
  Fine:   Checking match of request : '/webresources/upuser/getuser'; against '/logout'
  Fine:   /webresources/upuser/getUser at position 6 of 14 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
  Fine:   Request 'GET /webresources/upuser/getuser' doesn't match 'POST /login
  Fine:   /webresources/upuser/getUser at position 7 of 14 in additional filter chain; firing Filter: 'DefaultLoginPageGeneratingFilter'
  Fine:   /webresources/upuser/getUser at position 8 of 14 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
  Fine:   /webresources/upuser/getUser at position 9 of 14 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
  Fine:   pathInfo: arg1=/upuser/getUser; arg2=/upuser/getUser (property equals)
  Fine:   queryString: both null (property equals)
  Fine:   requestURI: arg1=/LmsWebService/webresources/upuser/getUser; arg2=/LmsWebService/webresources/upuser/getUser (property equals)
  Fine:   serverPort: arg1=8080; arg2=8080 (property equals)
  Fine:   requestURL: arg1=http://localhost:8080/LmsWebService/webresources/upuser/getUser; arg2=http://localhost:8080/LmsWebService/webresources/upuser/getUser (property equals)
  Fine:   scheme: arg1=http; arg2=http (property equals)
  Fine:   serverName: arg1=localhost; arg2=localhost (property equals)
  Fine:   contextPath: arg1=/LmsWebService; arg2=/LmsWebService (property equals)
  Fine:   servletPath: arg1=/webresources; arg2=/webresources (property equals)
  Fine:   Removing DefaultSavedRequest from session if present
  Fine:   /webresources/upuser/getUser at position 10 of 14 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
  Fine:   /webresources/upuser/getUser at position 11 of 14 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
  Fine:   SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken@4428690f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: a50e5eecf72b5493c618ffbb20f0; Granted Authorities: ROLE_USER'
  Fine:   /webresources/upuser/getUser at position 12 of 14 in additional filter chain; firing Filter: 'SessionManagementFilter'
  Fine:   /webresources/upuser/getUser at position 13 of 14 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
  Fine:   /webresources/upuser/getUser at position 14 of 14 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
  Fine:   Secure object: FilterInvocation: URL: /webresources/upuser/getUser; Attributes: [authenticated]
  Fine:   Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@4428690f: Principal: org.springframework.security.core.userdetails.User@36ebcb: Username: user; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: a50e5eecf72b5493c618ffbb20f0; Granted Authorities: ROLE_USER
  Fine:   Voter: org.springframework.security.web.access.expression.WebExpressionVoter@3fb68f13, returned: 1
  Fine:   Authorization successful
  Fine:   RunAsManager did not change Authentication object
  Fine:   /webresources/upuser/getUser reached end of additional filter chain; proceeding with original chain
  Info:   MonitorFilter::WARNING: the monitor filter must be the first filter in the chain.
  Fine:   Chain processed normally
  Fine:   SecurityContextHolder now cleared, as request processing completed
  </code></pre>
  
  <p>Can anyone tell me what I am doing wrong in all this thing. Or Spring Security doesn't work with glassfish.</p>
  
  <p>My Environment:</p>
  
  <ol>
  <li>Java EE 1.6</li>
  <li>Spring Security</li>
  <li>GlassFish Server 4.1</li>
  <li>MySql Databse</li>
  <li>Maven</li>
  <li>JPA</li>
  </ol>
  
  <blockquote>
    <p>EDIT # 1</p>
  </blockquote>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableWebMvcSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true, mode = org.springframework.context.annotation.AdviceMode.ASPECTJ, proxyTargetClass = true)
  public class UserDetailsSecurityConfig extends WebSecurityConfigurerAdapter {
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService( new CustomJDBCDaoImpl() );
  
      }
  }
  </code></pre>