title: Spring security access with multiple roles
body: <p>I want to define access for some pages for user who has one of following roles (ROLE1 or ROLE2)</p>
  
  <p>I'm trying to configure this in my spring security xml file as following:</p>
  
  <pre><code>&lt;security:http entry-point-ref="restAuthenticationEntryPoint" access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security" use-expressions="true"&gt;
          &lt;!-- skipped configuration --&gt;
          &lt;security:intercept-url pattern="/rest/api/myUrl*" access="hasRole('ROLE1') or hasRole('ROLE2')" /&gt;
  
          &lt;!-- skipped configuration --&gt;
      &lt;/security:http&gt;
  </code></pre>
  
  <p>I've tried various ways like:</p>
  
  <pre><code>access="hasRole('ROLE1, ROLE2')"
  access="hasRole('ROLE1', 'ROLE2')"
  access="hasAnyRole('[ROLE1', 'ROLE2]')"
  </code></pre>
  
  <p>etc</p>
  
  <p>but nothing seems to be working.</p>
  
  <p>I'm keep getting exception</p>
  
  <pre><code>java.lang.IllegalArgumentException: Unsupported configuration attributes:
  </code></pre>
  
  <p>or</p>
  
  <pre><code>java.lang.IllegalArgumentException: Failed to parse expression 'hasAnyRole(['ROLE1', 'ROLE2'])'
  </code></pre>
  
  <p>how should it be configured?</p>
  
  <p>Thanks</p>