title: Spring security: Role based access control
body: <p>I'm trying to add spring security to my web application (from <a href="http://slackspace.de/articles/roles-permissions-with-spring-security-3/" rel="nofollow">here</a>) which has to support roles and permissions model. I don't know where is the missing part in my configuration but @PreAuthorize doesn't work and I cannot trace it.
  Here is my app context file.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:tx="http://www.springframework.org/schema/tx"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
      http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd"&gt;
  
      &lt;context:component-scan base-package="com.njb.app" /&gt;
  
      &lt;import resource="db.xml" /&gt;
  
      &lt;bean id="jdbcUserService" 
          class="com.nj.app.SpringSecurityDaoImpl"&gt;
            &lt;property name="dataSource" ref="dataSource"/&gt;
            &lt;property name="enableGroups" value="true" /&gt;
            &lt;property name="enableAuthorities" value="false" /&gt;
            &lt;property name="groupAuthoritiesByUsernameQuery"&gt;
                 &lt;value&gt;SELECT R.SEC_ROLES, R.SEC_ROLES_ROLE_NAME, RI.SEC_RIGHT_NAME
                  FROM SEC_ROLES R 
                  JOIN SEC_USER_ROLE UR on R.SEC_ROLES = UR.SEC_ROLE_ID
                  JOIN SEC_USERS U on U.SEC_USERS = UR.SEC_USER_ID
                  JOIN SEC_ROLE_RIGHT RR ON RR.SEC_ROLE_ID = R.SEC_ROLES
                  JOIN SEC_RIGHTS RI ON RI.SEC_RIGHT_ID = RR.SEC_RIGHT_ID
                  WHERE U.SEC_USERS_USERNAME=?
              &lt;/value&gt;
            &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource"
          destroy-method="close"&gt;
        &lt;property name="driverClassName" value="${jdbc.driverClassName}" /&gt;
        &lt;property name="url" value="${jdbc.url}" /&gt;
        &lt;property name="username" value="${jdbc.username}" /&gt;
        &lt;property name="password" value="${jdbc.password}" /&gt;
      &lt;/bean&gt; 
  &lt;/beans&gt;
  </code></pre>
  
  <p>spring-security file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
                          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
  &lt;http auto-config="true" use-expressions="true"&gt;
      &lt;!--&lt;intercept-url pattern="/protected.jsf" access="isAuthenticated()" /&gt;--&gt;
      &lt;intercept-url pattern="*/user/*" access="hasRole('LIST_USERSSSSS')" /&gt;
      &lt;intercept-url pattern="/auth" access="permitAll()" /&gt;
  &lt;/http&gt;
  
  &lt;!-- Use database authentication provider. --&gt;
  &lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref="jdbcUserService"&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p></p>
  
  <p>db xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:mvc="http://www.springframework.org/schema/mvc"
      xmlns:context="http://www.springframework.org/schema/context"
      xmlns:tx="http://www.springframework.org/schema/tx"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd  
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
          http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd" default-autowire="byName"&gt;
  
      &lt;bean id="placeholderConfig"
          class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"&gt;
          &lt;property name="location" value="classpath:jdbc.properties" /&gt;
      &lt;/bean&gt;
          &lt;bean id="loadTimeWeaver" 
         class="org.springframework.instrument.classloading.glassfish.GlassFishLoadTimeWeaver" /&gt;
  
            &lt;bean id="entityManagerFactory"
                  class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean"&gt;
                &lt;property name="persistenceUnitName" value="PU" /&gt;
            &lt;/bean&gt;
  
  
      &lt;bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource"
          destroy-method="close"&gt;
          &lt;property name="driverClassName" value="${jdbc.driverClassName}" /&gt;
          &lt;property name="url" value="${jdbc.url}" /&gt;
          &lt;property name="username" value="${jdbc.username}" /&gt;
          &lt;property name="password" value="${jdbc.password}" /&gt;
  &lt;/bean&gt;
  
    &lt;!-- Transaction manager for JTA  --&gt;
  &lt;tx:jta-transaction-manager /&gt;
  &lt;!-- enable the configuration of transactional behavior based on annotations --&gt;
  &lt;tx:annotation-driven /&gt;
  
  &lt;!-- checks for @Autowired beans --&gt;
  &lt;context:annotation-config/&gt;    
  
  &lt;!-- Scan for Repository/Service annotations --&gt;
  &lt;context:component-scan base-package="...dao"/&gt;
  &lt;context:component-scan base-package="...service"/&gt;
  </code></pre>
  
  <p></p>
  
  <p>and web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
      version="2.5"&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/root-context.xml
              /WEB-INF/spring-security.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- Enable Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;!-- Allow login pages with JSF which redirects to security check, therefore we have to add the forward entry here --&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;dispatcher&gt;FORWARD&lt;/dispatcher&gt;
          &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
      &lt;/filter-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.request.RequestContextListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;servlet&gt;
          &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/servlet-context.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Here is how I'm using PreAuthorize annotation</p>
  
  <pre><code>    @PreAuthorize("hasRole('LIST_USERSS')")
      @RequestMapping(value = "/findAll", method = RequestMethod.GET, produces = {"application/json"})
      @ResponseBody
      public String findAll(HttpServletRequest request) { }
  </code></pre>
  
  <p>and here is the request </p>
  
  <pre><code>http://localhost:8080/app/user/findAll.json?
  </code></pre>