title: Java Spring Security AccessDecisionManager: UnanimousBased Failed to parse expression 'ROLE_ADMIN, IS_AUTHENTICATED_FULLY'
body: <p>I try to make some simple rememmber me authentication with spring security, but I found this error when I try to implement accessDecisionManager. here the error log :</p>
  
  <blockquote>
    <p>org.springframework.beans.factory.BeanCreationException: Error
    creating bean with name 'org.springframework.security.filterChains':
    Cannot resolve reference to bean
    'org.springframework.security.web.DefaultSecurityFilterChain#0' while
    setting bean property 'sourceList' with key [0]; nested exception is
    org.springframework.beans.factory.BeanCreationException: Error
    creating bean with name
    'org.springframework.security.web.DefaultSecurityFilterChain#0':
    Cannot resolve reference to bean
    'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0'
    while setting constructor argument with key [10]; nested exception is
    org.springframework.beans.factory.BeanCreationException: Error
    creating bean with name
    'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0':
    Cannot create inner bean '(inner bean)' of type
    [org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource]
    while setting bean property 'securityMetadataSource'; nested exception
    is org.springframework.beans.factory.BeanCreationException: Error
    creating bean with name '(inner bean)#19': Instantiation of bean
    failed; nested exception is
    org.springframework.beans.BeanInstantiationException: Could not
    instantiate bean class
    [org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource]:
    Constructor threw exception; nested exception is
    java.lang.IllegalArgumentException: Failed to parse expression
    'ROLE_ADMIN, IS_AUTHENTICATED_FULLY'</p>
  </blockquote>
  
  <p>and this is my xml file.
  web.xml</p>
  
  <pre><code>&lt;web-app id="WebApp_ID" version="2.4"
  xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
  http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
  &lt;display-name&gt;Spring Security Eksplorasi&lt;/display-name&gt;
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;!-- Spring MVC --&gt;
  &lt;servlet&gt;
      &lt;servlet-name&gt;kampus&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;kampus&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;!-- Spring Security --&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          /WEB-INF/spring-database.xml,
          /WEB-INF/spring-security.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  </code></pre>
  
  <p></p>
  
  <p>so this is my spring-security.xml</p>
  
  <pre><code>    &lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
      &lt;beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"&gt;
          &lt;beans:property name="decisionVoters"&gt;
              &lt;beans:list&gt;
                  &lt;beans:bean class="org.springframework.security.access.vote.RoleVoter"&gt;
                      &lt;beans:property name="rolePrefix" value="ROLE_"/&gt;
                  &lt;/beans:bean&gt;
                  &lt;beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/&gt;
              &lt;/beans:list&gt;
          &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
  
      &lt;security:http auto-config="true" use-expressions="true" access-decision-manager-ref="accessDecisionManager"&gt;
          &lt;security:remember-me key="kampus-rememberme" data-source-ref="dataSource" /&gt;
          &lt;security:intercept-url pattern="/admin/*" access="ROLE_ADMIN, IS_AUTHENTICATED_FULLY" /&gt;
          &lt;security:access-denied-handler error-page="/403" /&gt;
          &lt;security:form-login 
              login-page="/login" 
              default-target-url="/welcome" 
              authentication-failure-url="/login?error" 
              username-parameter="username"
              password-parameter="password" /&gt;
          &lt;security:logout logout-success-url="/login?logout"  /&gt;
          &lt;!-- enable csrf protection 
          &lt;csrf/&gt;--&gt;
      &lt;/security:http&gt;
      &lt;!-- 
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
                  &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
       --&gt;
  
      &lt;security:authentication-manager&gt;
          &lt;security:authentication-provider&gt;
              &lt;security:jdbc-user-service data-source-ref="dataSource"
                  users-by-username-query=
                      "select username,password, status from users where username=?"
                  authorities-by-username-query=
                      "select username, role from user_roles where username =?  " /&gt;
          &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>many thanks for your help friend. </p>