title: Custom Permission Evaluator is not getting invoked : Spring security 3.2
body: <p>I am trying to implement custom permission evaluator in my project. I have configured <code>spring security 3.2 and spring 4</code>. However, I am not able to get it working.</p>
  
  <p>springframework.version : 4.0.2.RELEASE</p>
  
  <p>springsecurity.version : 3.2.1.RELEASE</p>
  
  <p>I have annotated all my controller methods with <code>@PreAuthorize("hasPermission()")</code> annotation. But the call is not going into <code>hasPermission()</code> method in my custom evaluator. </p>
  
  <p>My code is pasted below :</p>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
               xmlns:beans="http://www.springframework.org/schema/beans"
               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
      &lt;global-method-security pre-post-annotations="enabled" jsr250-annotations="enabled"&gt;
          &lt;expression-handler ref="expressionHandler"/&gt;
      &lt;/global-method-security&gt;
  
      &lt;http auto-config="true" use-expressions="true" access-denied-page="/auth/auth/denied" &gt;
          &lt;intercept-url pattern="/auth/auth/login" access="denyAll"/&gt;
          &lt;intercept-url pattern="/auth/main/admin" access="hasRole('ROLE_ADMIN')"/&gt;
          &lt;intercept-url pattern="/auth/main/common" access="hasRole('ROLE_USER')"/&gt;   
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="user" password="123456" authorities="ROLE_USER" /&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
     &lt;beans:bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/&gt;
  
      &lt;!-- A custom service where Spring will retrieve users and their corresponding access levels  --&gt;
      &lt;!--&lt;bean id="customUserDetailsService" class="com.cj.customAuthProvider"/&gt;--&gt;
  
      &lt;beans:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"&gt;
          &lt;beans:property name="permissionEvaluator" ref="permissionEvaluator"/&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="permissionEvaluator" class="com.mycompany.common.evaluators.AuthorizationEvaluatorController"/&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p><strong>rest-config.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/context
              http://www.springframework.org/schema/context/spring-context-3.0.xsd
              http://www.springframework.org/schema/mvc
              http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd"&gt;
  
      &lt;context:component-scan base-package="com.reactore.common.web.controller"/&gt;
      &lt;mvc:annotation-driven/&gt;
      &lt;bean class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter"&gt;
          &lt;property name="order" value="1"/&gt;
          &lt;property name="messageConverters"&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.http.converter.json.MappingJackson2HttpMessageConverter"&gt;
                      &lt;property name="supportedMediaTypes" value="application/json"/&gt;
                  &lt;/bean&gt;
                  &lt;bean class="org.springframework.http.converter.StringHttpMessageConverter"&gt;
                      &lt;property name="supportedMediaTypes" value="text/plain;charset=UTF-8"/&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;web-app version="2.4"
           xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
      http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;classpath:domain-config.xml /WEB-INF/spring-security.xml&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt; 
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
              &lt;param-value&gt;/WEB-INF/rest-config.xml&lt;/param-value&gt;
          &lt;/init-param&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/auth/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>Permission Evaluator</strong></p>
  
  <pre><code>public class AuthorizationEvaluatorController extends ModuleController implements PermissionEvaluator{
  
      private boolean checkPermission(Long userId, String permissionId){
          //get user details and check if access is there.
          return false;
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Object userId, Object permissionId) {
          System.out.println("Checking the permission......");
          return checkPermission((Long)userId, (String)permissionId);
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Serializable serializable, String s, Object o) {
          return false;
      }
  }
  </code></pre>
  
  <p><strong>Controller</strong></p>
  
  <pre><code>@Controller
  public class RoleController {
      @RequestMapping(value="/role/{roleId}", method = RequestMethod.GET)
      @ResponseBody
      **@PreAuthorize("hasPermission(#roleId,3)")**
      public ResponseEntity&lt;Object&gt; getRoleFromId(@PathVariable("roleId") Long roleId) throws Exception {
          return getRoleService(roleId);
      }
  }
  </code></pre>