title: authentication object in thymeleaf is null or empty
body: <p>I'm using Spring boot, Spring Security and Thymeleaf. Currently, authentication and authorisation work fine when accessing pages, but I can't make the thymeleaf authorization work. The flow is very simple: I try accessing the admin.html page for which I need to have a role of 'ADMIN'. Spring Security correctly intercepts the request, forwards me to the login page first and when logged is as admin, it allows me to proceed. </p>
  
  <p>Now I'd like to "hide" some content on the admin page based on roles. So in my admin.html page I've got the following: </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;!DOCTYPE html&gt;
  &lt;html lang="en" xmlns:th="http://www.thymeleaf.org"&gt;
  &lt;head th:include="header :: common-header"&gt;
      &lt;title&gt;Admin Page&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
  
  &lt;div th:replace="navbar :: common-navbar"&gt;&lt;/div&gt;
  
  &lt;div class="container"&gt;
  
      &lt;div class="row"&gt;
  
          &lt;div class="col-md-6 col-md-offset-3"&gt;
  
              &lt;div class="well"&gt;
  
                  &lt;div th:if="${#authorization.expression('hasRole(''ROLE_ADMIN'')')}"&gt;
                      Secret Content
                  &lt;/div&gt;
  
                  &lt;div class="starter-template"&gt;
                      &lt;h1&gt;Hello Administrator!&lt;/h1&gt;
                      &lt;p class="lead"&gt;This page allows you to perform administrative tasks&lt;/p&gt;
                      &lt;form id="f" th:action="@{/logout}" method="post" role="form" class="form-group"&gt;
                          &lt;input type="submit" value="Logout" class="btn btn-primary" /&gt;
                      &lt;/form&gt;
                  &lt;/div&gt;
  
              &lt;/div&gt;
  
          &lt;/div&gt;
  
      &lt;/div&gt;
  
  &lt;/div&gt;&lt;!-- /.container --&gt;
  
  &lt;!-- Bootstrap core JavaScript
  ================================================== --&gt;
  &lt;!-- Placed at the end of the document so the pages load faster --&gt;
  &lt;div th:include="header :: before-body-script"&gt;
  
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;</code></pre>
  </div>
  </div>
  
  The problem I'm facing is that the #authorization object is null, although I'm clearly authenticated and authorized or I wouldn't be able to see the admin page. </p>
  
  <p>My pom.xml:</p>
  
  <pre><code>&lt;parent&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
      &lt;version&gt;1.3.1.RELEASE&lt;/version&gt;
      &lt;relativePath/&gt; &lt;!-- lookup parent from repository --&gt;
  &lt;/parent&gt;
  
  &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-thymeleaf&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-validation&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
      &lt;/dependency&gt;
  
  
      &lt;!-- Thymeleaf Dialect --&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.thymeleaf.extras&lt;/groupId&gt;
          &lt;artifactId&gt;thymeleaf-extras-springsecurity4&lt;/artifactId&gt;
          &lt;version&gt;3.0.0.BETA01&lt;/version&gt;
      &lt;/dependency&gt;
  </code></pre>
  
  <p>My security configuration class:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
  
      // Allows for static content
      http.authorizeRequests().antMatchers("/webjars/**").permitAll();
      http.authorizeRequests().antMatchers("/css/**").permitAll();
      http.authorizeRequests().antMatchers("/js/**").permitAll();
  
      // Defines security for everything else
      http
              .authorizeRequests()
                  .antMatchers("/").permitAll()
                  .antMatchers("/admin").hasRole("ADMIN")
                  .anyRequest().authenticated()
                  .and()
              .formLogin().loginPage("/login").failureUrl("/login?error").permitAll()
                  .and()
              .logout()
                  .permitAll();
  
  }
  
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth
              .inMemoryAuthentication()
              .withUser("user").password("password").roles("USER")
              .and()
              .withUser("admin").password("admin").roles("USER", "ADMIN");
  }
  </code></pre>
  
  <p>I've tried for many hours to solve this problem but without success. Of course, I could avoid using Spring boot and could use JSPs instead of thymeleaf but I really like the combination of Spring boot + Spring Security + Thymeleaf as it's closer to clean HTML. </p>
  
  <p>I've also tried using the sec element as in the following snippet: </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>  &lt;div sec:authorize="hasRole('ROLE_ADMIN1')"&gt;
        This content is only shown to administrators.
    &lt;/div&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>But, although it doesn't give an error, it shows the secret content for every role, even non existing ones. </p>
  
  <p>I've tried to define a SpringTemplateEngine by adding the SpringSecurityDialect, but I got an error saying I was declaring it twice (this is because of the Maven dependency on the extras library I suppose). </p>
  
  <p>I'd really appreciate some help please?</p>