title: Spring Security - how I can enable Method Security annotations?
body: <p>There is lot of similar questions at StackOverflow, but I can't find any answered :(</p>
  
  <p>I have web.xml like:</p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          /WEB-INF/spring-security.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/spring-web.xml&lt;/param-value&gt;
      &lt;/init-param&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;spring&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;FORWARD&lt;/dispatcher&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>and trying to configure <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/reference/el-access.html#d0e5101" rel="noreferrer">method security</a> with annotations. As I see it must be done by <code>&lt;sec:global-method-security pre-post-annotations="enabled"/&gt;</code>, placed at same context as other components, <code>spring-web.xml</code> at my case. So I have following <code>spring-web.xml</code>:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:sec="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
            http://www.springframework.org/schema/security
            http://www.springframework.org/schema/security/spring-security-3.0.xsd"
          default-autowire="byName"&gt;
  
      &lt;context:component-scan base-package="com.cleanplates.apiserv"/&gt;
      &lt;sec:global-method-security pre-post-annotations="enabled"/&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>and <code>spring-security.xml</code>:</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:sec="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
            http://www.springframework.org/schema/security
            http://www.springframework.org/schema/security/spring-security-3.0.xsd"&gt;
  
      &lt;bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"&gt;
          &lt;sec:filter-chain-map path-type="ant"&gt;
              &lt;sec:filter-chain pattern="/**"
                                filters="
                                  usernamePasswordProcessingFilter,
                                  rememberMeFilter,
                                  anonymousProcessingFilter,
                                  exceptionTranslationFilter,
                                  filterInvocationInterceptor"/&gt;
          &lt;/sec:filter-chain-map&gt;
      &lt;/bean&gt;
  
      &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"&gt;
          &lt;property name="decisionVoters"&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.access.vote.RoleVoter"/&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="anonymousProcessingFilter"
            class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter"&gt;
          &lt;property name="key" value="********"/&gt;
          &lt;property name="userAttribute"&gt;
              &lt;bean class="org.springframework.security.core.userdetails.memory.UserAttribute"&gt;
                  &lt;property name="authoritiesAsString"&gt;
                      &lt;list&gt;
                          &lt;value&gt;ROLE_ANONYMOUS&lt;/value&gt;
                      &lt;/list&gt;
                  &lt;/property&gt;
                  &lt;property name="password" value="none"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="usernamePasswordProcessingFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
          &lt;property name="filterProcessesUrl" value="/auth/password"/&gt;
          &lt;property name="usernameParameter" value="username"/&gt;
          &lt;property name="passwordParameter" value="password"/&gt;
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter"&gt;
          &lt;property name="rememberMeServices" ref="rememberMeServices"/&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices"&gt;
          &lt;property name="userDetailsService" ref="myUserDetailsService"/&gt;
          &lt;property name="key" value="*******"/&gt;
          &lt;property name="alwaysRemember" value="true"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="rememberMeAuthenticationProvider" class="org.springframework.security.authentication.RememberMeAuthenticationProvider"&gt;
          &lt;property name="key" value="******"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
          &lt;property name="authenticationEntryPoint"&gt;
              &lt;bean class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="filterInvocationInterceptor"
          class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;property name="securityMetadataSource"&gt;
              &lt;sec:filter-security-metadata-source&gt;
                &lt;sec:intercept-url pattern="/**" access="ROLE_ANONYMOUS,ROLE_USER" method="GET"/&gt;
                &lt;sec:intercept-url pattern="/**" access="ROLE_ADMIN" method="POST"/&gt;
                &lt;sec:intercept-url pattern="/**" access="ROLE_ADMIN" method="PUT"/&gt;
                &lt;sec:intercept-url pattern="/**" access="ROLE_ADMIN" method="DELETE"/&gt;
              &lt;/sec:filter-security-metadata-source&gt;
          &lt;/property&gt;
          &lt;property name="accessDecisionManager" ref="accessDecisionManager"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"&gt;
          &lt;property name="providers"&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.authentication.AnonymousAuthenticationProvider"&gt;
                      &lt;property name="key" value="***"/&gt;
                  &lt;/bean&gt;
                  &lt;bean class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
                      &lt;property name="saltSource"&gt;
                          &lt;bean class="org.springframework.security.authentication.dao.ReflectionSaltSource"&gt;
                              &lt;property name="userPropertyToUse" value="salt"/&gt;
                          &lt;/bean&gt;
                      &lt;/property&gt;
                      &lt;property name="userDetailsService" ref="myUserDetailsService"/&gt;
                      &lt;property name="passwordEncoder" ref="passwordEncoder"/&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="myUserDetailsService" class=".UserDetailsServiceImpl"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>The problem that after adding <code>&lt;sec:global-method-security</code> all controllers stop working. And I have following in logs:</p>
  
  <pre><code>PageNotFound:noHandlerFound:947 - No mapping found for HTTP request with URI [/some/page] in DispatcherServlet with name 'spring'
  </code></pre>
  
  <p>Everything is working when i remove this <code>global-security</code> element. If i'm adding it into <code>spring-security.xml</code> - nothing changes. Seems that it's not used, because methods annotated with <code>@PreAuthorize("hasRole('ROLE_ADMIN')")</code> (or any other role) are accessible by anyone.</p>
  
  <p>PS I'm using Spring 3.0.5.RELEASE and Spring Security 3.0.5.RELEASE</p>