title: Spring security custom FilterInvocationSecurityMetadataSource implementation 403 forbidden issue
body: <p>To make things short I'm trying to implement a custom FilterInvocationSecurityMetadataSource in order to secure/authorize certain parts/URL endpoints dynamically in my web app using spring security 5.0.6 and Spring Boot 2.0.3.</p>
  
  <p>The issue is that no matter what Role I use it always gives me the forbidden page.</p>
  
  <p>I have tried several things with different role names and (believe me) I have searched the whole internet even on spring security 5.0.6 books but nothing seems to work.</p>
  
  <p>This issue may be similar to this: <a href="https://stackoverflow.com/questions/48635647/spring-security-issue-with-securing-urls-dynamically">Spring Security issue with securing URLs dynamically</a></p>
  
  <p>Below the relevant parts of the custom FilterInvocationSecurityMetadataSource </p>
  
  <pre><code>public class DbFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
  
  public Collection&lt;ConfigAttribute&gt; getAttributes(Object object)
          throws IllegalArgumentException {
      FilterInvocation fi=(FilterInvocation)object;
      String url=fi.getRequestUrl();
  
      System.out.println("URL requested: " + url);
  
      String[] stockArr = new String[]{"ROLE_ADMIN"};
  
      return SecurityConfig.createList(stockArr);
  }
  </code></pre>
  
  <p>Below the relevant parts of the custom implementation of securitywebconfigAdapter</p>
  
  <pre><code>@Configuration
  public class Security extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
              .anyRequest().authenticated()
              .withObjectPostProcessor(new ObjectPostProcessor&lt;FilterSecurityInterceptor&gt;() {
              public &lt;O extends FilterSecurityInterceptor&gt; O postProcess(
                      O fsi) {
                  FilterInvocationSecurityMetadataSource newSource = new DbFilterInvocationSecurityMetadataSource();
                  fsi.setSecurityMetadataSource(newSource);
                  return fsi;
              }
          })
          .and()
          .formLogin()
          .permitAll();
  }
  </code></pre>
  
  <p>Below the relevant parts for custom userDetails authorities.
  The user has the role: ROLE_ADMIN in database.</p>
  
  <pre><code>public class CustomUserDetails extends User implements UserDetails {
  
  @Override
  public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
      List&lt;String&gt; dbRoles=new ArrayList&lt;String&gt;();
      for (Role userRole : super.getRoles()) {
          dbRoles.add(userRole.getType());
      }
  
      List&lt;SimpleGrantedAuthority&gt; authorities=new ArrayList&lt;SimpleGrantedAuthority&gt;();
      for (String role : dbRoles) {
          authorities.add(new SimpleGrantedAuthority(role));
      }
      return authorities;
  }
  </code></pre>
  
  <p>What am I doing wrong??<br>
  If more code is needed just comment below.<br>
  If you have even good books where I can learn this dynamic part of Spring security authorization comment below.
  Thanks!</p>