title: AOP MethodSecurityInterceptor not getting invoked in Spring Security
body: <p>I am using Spring Security 3.0.7 and my application is deployed on JBOSS. </p>
  
  <p>I am setting up <strong>org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor</strong> for my application to add restrictions on invocation of certain methods in services layer. But for some reason the interceptor is not getting called and I am able to invoke all the methods from a user with a role, <strong>ROLE_USER</strong>. 
  My security.xml looks like this:</p>
  
  <p></p>
  
  <pre><code>&lt;security:http auto-config='true' authentication-manager-ref="authenticationManager" use-expressions="true" request-matcher="ant" create-session="always"
      entry-point-ref="authenticationEntryPoint" &gt;
  
      &lt;security:intercept-url pattern="/login.jsp" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/configure/" access="hasRole('ROLE_ADMIN')"  /&gt;
      &lt;security:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
  
      &lt;security:form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=Authentication Failed!" default-target-url="/landing.do" 
      always-use-default-target="true"  /&gt;
  
      &lt;security:logout invalidate-session="true" delete-cookies="true" /&gt;
  
  
      &lt;security:session-management&gt;
          &lt;security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/login.jsp"/&gt;
      &lt;/security:session-management&gt;    
  &lt;/security:http&gt;
  
  &lt;security:method-security-metadata-source id="securityMetadataSource"&gt;
          &lt;security:protect method="com.services.CreateUserService.createUser" access="ROLE_ADMIN"/&gt;
          &lt;security:protect method="com.services.DeleteUser.deleteUser" access="ROLE_ADMIN"/&gt;
  &lt;/security:method-security-metadata-source&gt;
  
  &lt;security:global-method-security authentication-manager-ref="authenticationManager" access-decision-manager-ref="accessDecisionManager" 
  metadata-source-ref="securityMetadataSource" pre-post-annotations="disabled" secured-annotations="disabled" /&gt;
  
  &lt;bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
      &lt;property name="loginFormUrl" value="/login.jsp"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="myRoleVoter" class="com.interceptors.MyRoleVoter" /&gt;
  
  &lt;bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager" &gt;
      &lt;property name="providers"&gt;
          &lt;list&gt;
              &lt;ref local="daoAuthenticationProvider"/&gt;
          &lt;/list&gt;
      &lt;/property&gt;
  &lt;/bean&gt; 
  
  &lt;bean id="accessDecisionManager" class="com.interceptors.MyAccessDecisionManager"  p:allowIfAllAbstainDecisions="false" &gt;
      &lt;property name="decisionVoters"&gt;
          &lt;list&gt;
              &lt;ref local="myRoleVoter"/&gt;
          &lt;/list&gt;
      &lt;/property&gt; 
  &lt;/bean&gt;
  
  
  &lt;bean id="methodSecurity" class="org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;property name="accessDecisionManager" ref="accessDecisionManager"/&gt;
          &lt;property name="securityMetadataSource" ref="securityMetadataSource" /&gt;
  &lt;/bean&gt; 
  </code></pre>
  
  <p></p>
  
  <p>The authentication part is working absolutely fine. However, my MethodSecurityInterceptor is never invoked and hence not even my AccessDecisionManager or RoleVoter.</p>
  
  <p>If I add the reference of my accessDecisionManager in the first line, then my authentication layer stops working. All the requests pass to the AccessDecisionManager with the user as anonymous. </p>
  
  <pre><code>&lt;security:http security="none" pattern="/login.jsp" /&gt;
  
  &lt;security:http auto-config='true' authentication-manager-ref="authenticationManager" access-decision-manager-ref="accessDecisionManager" use-expressions="true" request-matcher="ant" create-session="always"
      entry-point-ref="authenticationEntryPoint" &gt;
  </code></pre>
  
  <p>I know either I am missing some TINY configuration, but I am unable to find that configuration anywhere in the docs. </p>