title: EL1008E:(pos 8):Property or field cannot be found on object of type '...security.web.access.expression.WebSecurityExpressionRoot' maybe not public?
body: <p>I am developing <code>Spring-Security-Access-Control-Example</code> using <strong>Spring MVC</strong> (version <code>4.3.1.RELEASE</code>) <strong>+ Spring Security</strong> <code>(4.1.1.RELEASE)</code>. Simply looking to implement access control or authorization on web application. When I simply lauch the URL: <a href="http://localhost:8080/Spring-Security-Access-Control-Example/admin" rel="noreferrer">http://localhost:8080/Spring-Security-Access-Control-Example/admin</a>. I get the following error and I really exhausted in solving the issue.</p>
  
  <p>The error message/stack:</p>
  
  <pre><code>java.lang.IllegalArgumentException: Failed to evaluate expression 'hasRole(ROLE_ADMIN)'
      at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:30)
      at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:52)
      at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:33)
      at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:63)
      at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
      at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
      at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter.doFilter(DefaultLoginPageGeneratingFilter.java:177)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
      at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
      at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
      at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
      at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
      at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:528)
      at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1099)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:670)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1520)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1476)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Unknown Source)
  Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 8): Property or field 'ROLE_ADMIN' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot' - maybe not public?
      at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:224)
      at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:94)
      at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:81)
      at org.springframework.expression.spel.ast.MethodReference.getArguments(MethodReference.java:154)
      at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:84)
      at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:131)
      at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:299)
      at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:26)
      ... 59 more
  </code></pre>
  
  <p><strong>WelcomeController.java</strong></p>
  
  <pre><code>@Controller
  public class WelcomeController {
  
      @RequestMapping(value = "/admin", method = RequestMethod.GET)
      public String welcomeAdmin(ModelMap model) {
          model.addAttribute("message", "Spring Security - ROLE_ADMIN");
          return "hello";
      }
  }
  </code></pre>
  
  <p><strong>hello.jsp:</strong></p>
  
  <pre><code>&lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%&gt;
  &lt;html&gt;
  &lt;body&gt;
      &lt;h3&gt;Message : ${message}&lt;/h3&gt;   
      &lt;a href="&lt;c:url value="j_spring_security_logout" /&gt;" &gt; Logout&lt;/a&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>mvc-dispatcher-servlet.xml</strong></p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="
          http://www.springframework.org/schema/beans     http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/context  http://www.springframework.org/schema/context/spring-context.xsd"&gt;
  
      &lt;context:component-scan base-package="com.mkyong.common.controller" /&gt;
  
      &lt;bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;property name="prefix" value="/WEB-INF/pages/" /&gt;
          &lt;property name="suffix" value=".jsp" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource"&gt;
          &lt;property name="basenames"&gt;
              &lt;list&gt;
                  &lt;value&gt;mymessages&lt;/value&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:util="http://www.springframework.org/schema/util"
      xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
          http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"&gt;
  
      &lt;http auto-config="true" use-expressions="true"&gt;
          &lt;intercept-url pattern="/admin*" access="hasRole(ROLE_ADMIN)" /&gt;
          &lt;logout logout-success-url="/admin" /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="mkyong" password="password" authorities="ROLE_USER" /&gt;
                  &lt;user name="eclipse" password="password" authorities="ROLE_ADMIN" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;web-app id="WebApp_ID" version="2.4"
      xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
      http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
      &lt;display-name&gt;Spring MVC Application&lt;/display-name&gt;
  
      &lt;!-- Spring MVC --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/mvc-dispatcher-servlet.xml,
              /WEB-INF/spring-security.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>pom.xml</strong></p>
  
  <pre><code>&lt;properties&gt;
          &lt;jdk.version&gt;1.8&lt;/jdk.version&gt;
          &lt;springframework.version&gt;4.3.1.RELEASE&lt;/springframework.version&gt;
          &lt;springsecurity.version&gt;4.1.1.RELEASE&lt;/springsecurity.version&gt;
          &lt;logback.version&gt;1.1.7&lt;/logback.version&gt;
          &lt;jcl-over-slf4j.version&gt;1.7.21&lt;/jcl-over-slf4j.version&gt;
      &lt;/properties&gt;
  
      &lt;dependencies&gt;
          &lt;!-- Spring --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
              &lt;version&gt;${springframework.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
              &lt;version&gt;${springframework.version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;!-- Spring Security --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
              &lt;version&gt;${springsecurity.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
              &lt;version&gt;${springsecurity.version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;!-- logging, slf4j --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.slf4j&lt;/groupId&gt;
              &lt;artifactId&gt;jcl-over-slf4j&lt;/artifactId&gt;
              &lt;version&gt;${jcl-over-slf4j.version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;ch.qos.logback&lt;/groupId&gt;
              &lt;artifactId&gt;logback-classic&lt;/artifactId&gt;
              &lt;version&gt;${logback.version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
              &lt;artifactId&gt;javax.servlet-api&lt;/artifactId&gt;
              &lt;version&gt;3.1.0&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;javax.servlet.jsp&lt;/groupId&gt;
              &lt;artifactId&gt;javax.servlet.jsp-api&lt;/artifactId&gt;
              &lt;version&gt;2.3.1&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;javax.servlet&lt;/groupId&gt;
              &lt;artifactId&gt;jstl&lt;/artifactId&gt;
              &lt;version&gt;1.2&lt;/version&gt;
          &lt;/dependency&gt;
  </code></pre>
  
  <p>Note: I followed many links, but whatever solution had provided I already applied that still its not working. Why ?</p>