title: spring-boot extended authorization
body: <p>I've a spring boot application, for which I'm trying to implement a custom authorization schema extending the standard <code>@RolesAllowed</code>.</p>
  
  <p>I've created a custom <code>AccessDecisionManage</code>r wich reads the <code>@RolesAllowed</code> and if there is an argument annotated with my custom annotation I will check if the user has the specified role within the specified scope.</p>
  
  <pre><code>@RequestMapping(value = "/{id}/user/list", method = RequestMethod.GET)
  @RolesAllowed("manager")
  public List&lt;User&gt; userList(@PathVariable("id") @AuthScope Project project) throws NotFoundException {
              return projectService.findUsersByProject(project);
  }
  </code></pre>
  
  <p>I've implemented an <code>AccessDecisionManager</code> with the logic required for my custom authorization schema now I'm having trouble configuring my application security to use this <code>AccessDecisionManager</code>.</p>
  
  <pre><code> @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
                  .authorizeRequests()
                      .accessDecisionManager(accessDecisionManager())
                      .anyRequest().permitAll()
                      .and()
                  .csrf()
                      .disable()
                      .httpBasic();
      }
  </code></pre>
  
  <p>Here is the error I'm getting:</p>
  
  <pre><code>AccessDecisionManager does not support secure object class: class org.springframework.security.web.FilterInvocation
  </code></pre>
  
  <p>Any ideas on what I'm doing wrong ?
  Cheers </p>