title: @Secured function getting Access Denied for authorized user
body: <p>I've followed quite a few threads to implement Spring Security to my rest API. Initially I get stuck at @Secured annotation being ignored, now that I got that resolved, I am stuck at getting access denied.</p>
  
  <p>Feels like my problem sound very similar to: <a href="https://stackoverflow.com/questions/9302770/secured-with-granted-authorities-throws-access-denied-exception">@secured with granted authorities throws access denied exception</a> - but I am still getting access denied.</p>
  
  <p>Here's my setup:</p>
  
  <p><strong>spring-security.xml</strong>
      
          
      </p>
  
  <pre><code>&lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref="userDetailsService"&gt;
          &lt;password-encoder ref="passwordEncoder" /&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;beans:bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.PlaintextPasswordEncoder"/&gt;
  
  &lt;user-service id="userDetailsService"&gt;
      &lt;user name="john" password="john1" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
      &lt;user name="jane" password="jane1" authorities="ROLE_USER" /&gt;
      &lt;user name="apiuser" password="apiuser" authorities="PERMISSION_TEST" /&gt;
  &lt;/user-service&gt;
  </code></pre>
  
  <p> </p>
  
  <p><strong>Controller</strong>:</p>
  
  <pre><code>@Controller
  @RequestMapping("/secure")
  public class SecureController
  {
      private static final Logger logger = Logger.getLogger(SecureController.class);
  
      @Secured("PERMISSION_TEST")
      @RequestMapping(value = "/makeRequest", method = RequestMethod.GET)
      @ResponseBody
      public SimpleDTO executeSecureCall()
      {
          logger.debug("[executeSecureCall] Received request to a secure method");
  
          SimpleDTO dto = new SimpleDTO();
          dto.setStringVariable("You are authorized!");
  
          return dto;
      }
  
  }
  </code></pre>
  
  <p>Now - <strong>without</strong> the proper </p>
  
  <pre><code>&lt;security:global-method-security secured-annotations="enabled"/&gt;
  </code></pre>
  
  <p>My request goes through (this is because the @Secured annotation is ignored). When I put it in and accessing it using "apiuser"/"apiuser", I kept getting access denied, the debug log:</p>
  
  <pre><code>11:42:43,899 [http-apr-8080-exec-4] DEBUG MethodSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@cc12af5d: Principal: org.springframework.security.core.userdetails.User@d059c8e5: Username: apiuser; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: PERMISSION_TEST; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: PERMISSION_TEST
  
  11:42:43,899 [http-apr-8080-exec-4] DEBUG AffirmativeBased - Voter: org.springframework.security.access.vote.RoleVoter@2a9a42ef, returned: 0
  11:42:43,900 [http-apr-8080-exec-4] DEBUG AffirmativeBased - Voter: org.springframework.security.access.vote.AuthenticatedVoter@75a06ec2, returned: 0
  
  11:42:43,902 [http-apr-8080-exec-4] DEBUG AnnotationMethodHandlerExceptionResolver - Resolving exception from handler [com.test.webapp.spring.controller.SecureController@342d150f]: org.springframework.security.access.AccessDeniedException: Access is denied
  11:42:43,905 [http-apr-8080-exec-4] DEBUG ResponseStatusExceptionResolver - Resolving exception from handler [com.test.webapp.spring.controller.SecureController@342d150f]: org.springframework.security.access.AccessDeniedException: Access is denied
  11:42:43,906 [http-apr-8080-exec-4] DEBUG DefaultHandlerExceptionResolver - Resolving exception from handler [com.test.webapp.spring.controller.SecureController@342d150f]: org.springframework.security.access.AccessDeniedException: Access is denied
  11:42:43,909 [http-apr-8080-exec-4] DEBUG DispatcherServlet - Could not complete request
  org.springframework.security.access.AccessDeniedException: Access is denied
  </code></pre>
  
  <p>Thoughts?</p>
  
  <p>Thanks in advance!</p>