title: Why does isAuthenticated() works, but not access="hasRole('VERIFIED')" doesn't work in Spring Security project?
body: <p>I am working on Spring project using Spring Security and Spring MVC 4.0.1. The code (intercept url /loginSuccess) works fine for access="isAuthenticated()" , but it doesn't work for access="hasRole('VERIFIED')"</p>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;security:http auto-config='true' use-expressions='true'&gt;
       &lt;security:form-login login-page="/login" default-target-url="/loginSuccess" 
          authentication-failure-url="/checkVerification" 
          username-parameter="mobile_Number"
          password-parameter="password"
          always-use-default-target="true"/&gt; 
        &lt;security:intercept-url pattern="/loginCheck" access="hasRole('VERIFIED')"/&gt;
        &lt;security:intercept-url pattern="/loginSuccess" access="isAuthenticated()"/&gt;
        &lt;security:intercept-url pattern="/home" access="permitAll" /&gt;
        &lt;security:intercept-url pattern="/RankOption/**" access="hasRole('VERIFIED')"/&gt;
        &lt;security:logout logout-url="/logout"/&gt;
  
  &lt;/security:http&gt;
  
         &lt;security:authentication-manager erase-credentials="false" alias="authenticationManager"&gt;
              &lt;security:authentication-provider ref="myAuthenticationProvider"&gt;
              &lt;/security:authentication-provider&gt; 
         &lt;/security:authentication-manager&gt; 
  
      &lt;b:bean id="bcryptEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /&gt;
  
      &lt;b:bean id="myAuthenticationProvider" class="com.cT.www.provider.CustomAuthenticationProvider"&gt;
      &lt;/b:bean&gt;   
  </code></pre>
  
  <p>SomeController.java</p>
  
  <pre><code>@Component
     public class CustomAuthenticationProvider implements    AuthenticationProvider {
  
      public CustomAuthenticationProvider() {
          super();
      }
  
  
      @Autowired
      private PersonService personService;    
  
  
      @Override
      public Authentication authenticate(Authentication authentication)
              throws AuthenticationException {
  
          System.out.println(authentication.getName() + "principal" +(String) authentication.getCredentials()+
                  authentication.getAuthorities().size() + " " + authentication.getPrincipal().toString());
          BCryptPasswordEncoder bcryptPasswordEncoder = new BCryptPasswordEncoder();
  
          String username = authentication.getName();
  
          String password = authentication.getCredentials().toString();
  
          UserSignUp user = (UserSignUp) personService.loadUserByUsername(username);
  
          if (user == null || !user.getUsername().equalsIgnoreCase(username)) {
              throw new BadCredentialsException("Username not found.");
          }
  
          if(password != null || !password.isEmpty()){
              if (BCrypt.checkpw(bcryptPasswordEncoder.encode(password), user.getPassword())) {
                  throw new BadCredentialsException("Wrong password.");
              }
         }
  
          List&lt;Role&gt; authorities = user.getAuthorities();
  
          return new UsernamePasswordAuthenticationToken(user, password, authorities);
  
      }
  
      @Override
      public boolean supports(Class&lt;?&gt; arg0) {
          // TODO Auto-generated method stub
          return true;
      }
  
  }
  </code></pre>
  
  <p>ServiceImpl.java</p>
  
  <pre><code>   @Override
      @Transactional
      public UserSignUp loadUserByUsername(String mobile_Number)
          throws UsernameNotFoundException {
      this.getMobile_Number_N_Password(Long.parseLong(mobile_Number));
      logger.trace("Trying to find User with mobile Number" + mobile_Number);
  
  
  
      List result = personDAO.getMobile_Number_N_Password(mobile_Number);
  
      String existing_Password = null;
      Boolean verification_Boolean = false;
  
      if(result != null){
          if(result.get(0) != null){
              for(Iterator itr = result.iterator(); itr.hasNext();){
  
                  Object[] myResult = (Object[]) itr.next();
  
                  existing_Password = (String) myResult[0];
  
                  verification_Boolean = (Boolean) myResult[1];
  
  
  
              }           
          }   
  
  
      }   
  
      if(result == null){
          throw new UsernameNotFoundException("No user found with mobile number" + mobile_Number);
      }
  
  
  
  
  
      UserSignUp retrievedUserDetails = new UserSignUp();
  
      retrievedUserDetails.setMobile_Number(mobile_Number);
      retrievedUserDetails.setPassword(existing_Password);
  
      Role r = new Role();
      r.setName("VERIFIED");
      List&lt;Role&gt; roles = new ArrayList&lt;Role&gt;();
      roles.add(r);
  
      retrievedUserDetails.setAuthorities(roles);
  
      return retrievedUserDetails;
  
  
  }
  </code></pre>
  
  <p>Model
  Role.java</p>
  
  <pre><code>import org.springframework.security.core.GrantedAuthority;
  
  public class Role implements GrantedAuthority {
  
      private String name;
  
  
      public String getName() {
          return name;
      }
  
      public void setName(String name) {
          this.name = name;
      }
  
  
      @Override
      public String getAuthority() {
          // TODO Auto-generated method stub
          return null;
      }
  
  }
  </code></pre>
  
  <p>UserSignUp.java</p>
  
  <pre><code>    @Column
      @ElementCollection
      private List&lt;Role&gt; authorities;
  
      public List&lt;Role&gt; getAuthorities() {
             return authorities;
      }
  
      public void setAuthorities(List&lt;Role&gt; authorities) {
            this.authorities = authorities;
      }
  </code></pre>
  
  <p>I haven't set up the column authorities in db yet. Would it be causing the issue. But when I debug the code, I see the authorities variable is getting populated.</p>