title: Spring Security Interceptor-URL not working
body: <p>I am using Spring Security 3.0.3 for a project.</p>
  
  <p>This project has 3 areas which should be accessible for different people</p>
  
  <p>Therefore I create the following structure
   - WEB-INF/ (for everybody = unprotected)
   - WEB-INF/app (for users = ROLE_USER)
   - WEB-INF/app/admin.jsf (for admins = ROLE_ADMIN)</p>
  
  <p>That admin.jsf is in the same directory I can't change unfortunatly.</p>
  
  <p>My user info is loaded from the database.</p>
  
  <p>They are defined like:</p>
  
  <pre><code>&lt;bean id="preAuthenticatedProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/&gt; &lt;security:http entry-point-ref="preAuthenticatedProcessingFilterEntryPoint" &gt;
     &lt;security:custom-filter position="PRE_AUTH_FILTER" ref="MyFilter"/&gt;
     &lt;security:intercept-url pattern="/app/admin.jsf" access="ROLE_ADMIN" /&gt;         
     &lt;security:intercept-url pattern="/app/**" access="ROLE_USER" /&gt;
     &lt;security:intercept-url pattern="/**" access="" /&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>Now, everything works great. Userdata is loaded, roles are set according to the DB but unfortunatly</p>
  
  <ul>
  <li>the unprotected area is accessable for all (thats ok)</li>
  <li>admins can see every page (since they are ROLE_USER too)</li>
  <li>role users CAN NOT enter the pages in app</li>
  </ul>
  
  <p>Does anyone have a hint what I did wrong?
  I am testing it locally and the browser url is: <a href="http://localhost:8080/my_app/app/admin.jsf" rel="nofollow">http://localhost:8080/my_app/app/admin.jsf</a></p>
  
  <hr>
  
  <p>So far I was able to identify source of the problem that spring security ignores my roles. The patterns of the intercept urls are working, unfortunatly my defined roles don't. </p>
  
  <hr>
  
  <p>I finally was able to identify the problem: a colleague checked in a second config file and I modiefied the wrong one. <em>grml</em></p>