title: @PreAuthorize Not working with spring security 4
body: <p>I am facing issues with <code>@PreAuthorize</code> annotation. There are two things to be done. </p>
  
  <ul>
  <li><p>Retrieving all employees should be done by one who has the authority <code>USER</code> or <code>ADMIN</code>.</p></li>
  <li><p>Deleting employee should be done by one with authority only <code>ADMIN</code>.
  I need to use method level authorization with <code>spring-security-4</code>.</p></li>
  </ul>
  
  <p><a href="https://i.stack.imgur.com/Fmcyv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Fmcyv.png" alt="Project_explorer_view"></a></p>
  
  <p>User.java</p>
  
  <pre><code>package com.nikunj.SpringMethodLevelAuthorization;
  public class user {
      int id;
      String firstName;
      String type;
  
      public user(int id, String firstName, String type){
          this.id = id;
          this.firstName = firstName;
          this.type = type;
      }
      public int getId() {
          return id;
      }
      public void setId(int id) {
          this.id = id;
      }
      public String getFirstName() {
          return firstName;
      }
      public void setFirstName(String firstName) {
          this.firstName = firstName;
      }
      public String getType() {
          return type;
      }
      public void setType(String type) {
          this.type = type;
      }
  }
  </code></pre>
  
  <p>userService.java</p>
  
  <pre><code>package com.nikunj.SpringMethodLevelAuthorization;
  import java.util.Vector;
  import org.springframework.security.access.prepost.PreAuthorize;
  public interface userService {
      @PreAuthorize("hasRole('ADMIN')")
      public void deleteUser(int id);
  
      @PreAuthorize("hasRole('ADMIN') or hasRole('USER')")
      public Vector&lt;user&gt; getAllUsers();
  }
  </code></pre>
  
  <p>userImplementation.java</p>
  
  <pre><code>package com.nikunj.SpringMethodLevelAuthorization;
  import java.util.Vector;
  public class userImplementation implements userService {
      Vector&lt;user&gt; users; 
      public userImplementation(){
          users = new Vector&lt;user&gt;();
          users.add(new user(1,"Nikunj","SE"));
          users.add(new user(2,"Abdul","SSE"));
          users.add(new user(3,"Mrinal","LSE"));
          users.add(new user(4,"Anurag","SE"));
          users.add(new user(5,"Naresh","LSE"));
          users.add(new user(6,"Mahesh","SE"));
      }
  
      public user findById(int id){
          for(user u : users){
              if(u.getId()==id){
                  return u;
              }
          }
          return null;
      }
  
      public Vector&lt;user&gt; getAllUsers(){
          return users;
      }
  
      public void deleteUser(int id){
          user u = findById(id);
          users.remove(u);
      }
  }
  </code></pre>
  
  <p>homeController.java</p>
  
  <pre><code>package com.nikunj.SpringMethodLevelAuthorization;
  
  import java.util.Vector;
  
  import org.springframework.stereotype.Controller;
  import org.springframework.ui.Model;
  import org.springframework.web.bind.annotation.PathVariable;
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  @Controller
  public class HomeController {
      userImplementation ui=new userImplementation();
      Vector&lt;user&gt; users;
  
      @RequestMapping(value = { "/users" },method = RequestMethod.GET)
      public String getAllUsers(Model model) {
          System.out.println("in getAll()");
          users=ui.getAllUsers();
          model.addAttribute("users", users);
          return "allUsers";
      }
  
  
      @RequestMapping(value = { "/delete/{id}" }, method = RequestMethod.GET)
      public String deleteUser(@PathVariable int id,Model model){
          System.out.println("in delete()");
          ui.deleteUser(id);
          users=ui.getAllUsers();
          model.addAttribute("users", users);
          return "allUsers";  
      }   
  }
  </code></pre>
  
  <p>dispatcher-servlet.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/mvc"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:context="http://www.springframework.org/schema/context"
      xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"&gt;
      &lt;!-- Enables the Spring MVC @Controller programming model --&gt;
      &lt;annotation-driven /&gt;
  
      &lt;!-- Handles HTTP GET requests for /resources/** by efficiently serving up static resources in the ${webappRoot}/resources directory --&gt;
      &lt;resources mapping="/resources/**" location="/resources/" /&gt;
  
      &lt;!-- Resolves views selected for rendering by @Controllers to .jsp resources in the /WEB-INF/views directory --&gt;
      &lt;beans:bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;beans:property name="prefix" value="/WEB-INF/views/" /&gt;
          &lt;beans:property name="suffix" value=".jsp" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;context:component-scan base-package="com.nikunj.SpringMethodLevelAuthorization" /&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd"&gt;
  
      &lt;http auto-config="true"&gt;
          &lt;intercept-url pattern="/" access="hasRole('USER') or hasRole('ADMIN')" /&gt;
      &lt;/http&gt; 
  
      &lt;!-- Eable method level security --&gt;
      &lt;global-method-security pre-post-annotations="enabled"/&gt;    
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider&gt;
              &lt;user-service&gt;
                  &lt;user name="abdul" password="root123" authorities="ROLE_ADMIN"/&gt;
                  &lt;user name="nikunj" password="secret" authorities="ROLE_USER"/&gt;
              &lt;/user-service&gt;
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
                          http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
  
      &lt;!-- Processes application requests --&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;!-- The definition of the Root Spring Container shared by all Servlets and Filters --&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
                       /WEB-INF/dispatcher-servlet.xml
                       /WEB-INF/spring-security.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;!-- Creates the Spring Container shared by all Servlets and Filters --&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
  
      &lt;!-- Spring Security Configuration --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>