title: Spring Security + JSR 250 + EJB 3.1 not working
body: <p>My JEE6 webapp (mainly CDI, EJB 3.1 and JSF 2) uses Spring Security 3, but not Spring dependency injection or MVC. I implemented a Spring AuthenticationProvider to handle the login. During login, I add roles to my users depending on some custom business logic.</p>
  
  <p>Now, I want to use JSR 250 annotations to secure my business logic. My business logic is implemented using stateless EJBs (version 3.1).</p>
  
  <p>I include Spring's context XML file in web.xml as follows:</p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          /WEB-INF/spring/applicationContext-security.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  </code></pre>
  
  <p>And here is the content of the XML file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:security="http://www.springframework.org/schema/security"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
  
  &lt;security:global-method-security jsr250-annotations="enabled"/&gt;
  
  &lt;security:http auto-config="false"&gt;
      &lt;security:intercept-url pattern="/pages/**" access="ROLE_USER"/&gt;
      &lt;security:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;security:form-login login-page="/login.jsf"/&gt;
      &lt;security:anonymous/&gt;
      &lt;security:custom-filter ref="logoutFilter" position="LOGOUT_FILTER"/&gt;
  &lt;/security:http&gt;
  
  &lt;bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
      &lt;constructor-arg index="0" value="/login.jsf"/&gt;
      &lt;constructor-arg index="1"&gt;
          &lt;list&gt;
              &lt;bean id="customLogoutHandler" class="com.example.client.security.CustomLogoutHandler"/&gt;
              &lt;bean id="securityContextLogoutHandler" class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
      &lt;property name="filterProcessesUrl" value="/logout.jsf"/&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider ref="customAuthenticationProvider"/&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="customAuthenticationProvider"
        class="com.example.client.security.CustomAuthenticationProvider"/&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>In my classes, I use class annotations (type level) to say all methods should be only accessible to users with a certain role:</p>
  
  <pre><code>@Model
  @RolesAllowed("ROLE_GROUP")
  public class UserListAction {
  </code></pre>
  
  <p>However, also users with only the role ROLE_USER have access to any function of this class. I verified that the users don't have the wrong roles while debugging with the following code:</p>
  
  <pre><code>    Collection&lt;? extends GrantedAuthority&gt; authorities = SecurityContextHolder.getContext().getAuthentication().getAuthorities();
  </code></pre>
  
  <p>As expected, the authorities collection doesn't contain the ROLE_GROUP authority.</p>
  
  <p>It seems my annotations are completely ignored, but why? I also tried Spring's pre-post annotations, but they also seem to have no effect.</p>