title: Why is my custom PermissionEvaluator not working?
body: <p>I can’t understand why my security doesn’t work properly. Method hasPermission() in Evaluator class not even called. I think there is something wrong with my security config.</p>
  
  <p>My Security config:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;bean:beans xmlns:bean="http://www.springframework.org/schema/beans"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xmlns:sec="http://www.springframework.org/schema/security"
              xmlns="http://www.springframework.org/schema/security"
              xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans.xsd
              http://www.springframework.org/schema/security
              http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
      &lt;sec:http use-expressions="true"&gt;
          &lt;sec:intercept-url pattern="/favicon.ico" access="permitAll"/&gt;
          &lt;sec:intercept-url pattern="/resources/**" access="permitAll"/&gt;
          &lt;sec:intercept-url pattern="/login" access="permitAll"/&gt;
          &lt;sec:form-login login-page="/login"
                          username-parameter="login"
                          password-parameter="password"
                          authentication-failure-url="/login?error"
                          authentication-success-handler-ref="successHandler"/&gt;
          &lt;sec:logout logout-url="/logout" logout-success-url="/login?logout"/&gt;
          &lt;sec:access-denied-handler error-page="/WEB-INF/views/error/403.jsp"/&gt;
      &lt;/sec:http&gt;
  
      &lt;sec:authentication-manager&gt;
          &lt;sec:authentication-provider ref="userAuthenticationProvider"/&gt;
      &lt;/sec:authentication-manager&gt;
  
      &lt;sec:global-method-security pre-post-annotations="enabled" secured-annotations="enabled"&gt;
          &lt;sec:expression-handler ref="expressionHandler"/&gt;
      &lt;/sec:global-method-security&gt;
  
      &lt;bean:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"&gt;
          &lt;bean:property name="permissionEvaluator" ref="permissionEvaluator"/&gt;
      &lt;/bean:bean&gt;
  
      &lt;bean:bean id="permissionEvaluator" class="de.mark.project.security.UserPermissionEvaluator"&gt;
          &lt;bean:constructor-arg ref="userSecurityService"/&gt;
      &lt;/bean:bean&gt;
  
      &lt;bean:bean id="successHandler" class="de.mark.project.security.UrlAuthenticationSuccessHandler"/&gt;
      &lt;bean:bean id="userSecurityService" class="de.mark.project.service.UserService"/&gt;
  
      &lt;bean:bean name="userAuthenticationProvider" class="de.mark.project.security.UserAuthenticationProvider"&gt;
          &lt;bean:constructor-arg ref="userSecurityService"/&gt;
      &lt;/bean:bean&gt;
  
  &lt;/bean:beans&gt;
  </code></pre>
  
  <p>Here is my custom evaluator:</p>
  
  <pre><code>public class UserPermissionEvaluator implements PermissionEvaluator {
      private UserService service;
  
      @Autowired
      public UserPermissionEvaluator(UserService service) {
          this.service = service;
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, 
                                   Serializable targetId,  String targetType, 
                                   Object permission) {
  
          UserDetails principal = (UserDetails) authentication.getPrincipal();
          User authorizedUser = service.getUser(principal.getUsername());
          Collection&lt;Permission&gt; userPermissions = authorizedUser.getPermissions();
  
          for (Permission p : userPermissions) {
              if (p.getName().equals(allowedPermission)) {
                  return true;
              }
          }
          return false;
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, 
                                   Serializable targetId,  String targetType, 
                                   Object permission) {
          throw new RuntimeException("Error");
      }
  }
  </code></pre>
  
  <p>Method in the controller which using security:</p>
  
  <pre><code>@RequestMapping(method = RequestMethod.GET)
  @PreAuthorize("hasPermission(null, 'create_user')")
  public String createUserForm(@ModelAttribute("user") User user) {
      return "user/internal/form/credentialForm";
  }
  </code></pre>
  
  <p>Any ideas how to fix it?</p>
  
  <p>UPD:</p>
  
  <pre><code>&lt;web-app
          version="2.4"
          xmlns="http://java.sun.com/xml/ns/j2ee"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
          http://java.sun.com/xml/ns/j2ee/web-app_2_5.xsd"&gt;
  
  
      &lt;!-- log4j configuration --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;log4jConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;classpath:/log4j.properties&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.util.Log4jConfigListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
  
      &lt;!-- Config Setup --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              classpath:/spring-config/security.xml
              classpath:/spring-config/data.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
  
      &lt;!-- Spring MVC --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;mvc&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;classpath:/spring-config/mvc.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;mvc&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
  
      &lt;!-- Error handling --&gt;
      &lt;error-page&gt;
          &lt;error-code&gt;404&lt;/error-code&gt;
          &lt;location&gt;/WEB-INF/views/error/404.jsp&lt;/location&gt;
      &lt;/error-page&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>UPD 2</p>
  
  <p>Spring MVC config:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xmlns:sec="http://www.springframework.org/schema/security"
         xmlns:ctx="http://www.springframework.org/schema/context"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/mvc
          http://www.springframework.org/schema/mvc/spring-mvc.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security.xsd
          http://www.springframework.org/schema/context
          http://www.springframework.org/schema/context/spring-context.xsd"&gt;
  
      &lt;mvc:annotation-driven/&gt;
      &lt;ctx:component-scan base-package="de.mark.project.web"/&gt;
      &lt;sec:global-method-security pre-post-annotations="enabled"/&gt;
      &lt;mvc:resources mapping="/resources/**" location="classpath:/style/"/&gt;
  
      &lt;mvc:interceptors&gt;
          &lt;bean id="webContentInterceptor" class="org.springframework.web.servlet.mvc.WebContentInterceptor"&gt;
              &lt;property name="cacheSeconds" value="0"/&gt;
              &lt;property name="useExpiresHeader" value="true"/&gt;
              &lt;property name="useCacheControlHeader" value="true"/&gt;
              &lt;property name="useCacheControlNoStore" value="true"/&gt;
          &lt;/bean&gt;
      &lt;/mvc:interceptors&gt;
  
      &lt;bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;property name="prefix" value="/WEB-INF/views/"/&gt;
          &lt;property name="suffix" value=".jsp"/&gt;
      &lt;/bean&gt;
  &lt;/beans&gt;
  </code></pre>