Spring method level security not working

Amardeep

Asked on May 20, 2015

Hi,

I am developing spring security application in which I am using method level security using annotation. Methods are

@Secured("authenticated")
public void method1();

@PreAuthorize("hasRole('ADMIN')")
public void method2();

While I run my application, they are not working.

Mohit

Replied on May 20, 2015

You need to check for global method security configuration.

1. If you are using xml based spring security, check if you have used

<global-method-security secured-annotations="enabled", pre-post-annotations="enabled"/>

where secured-annotations is for @Secured and pre-post-annotations is for @PreAuthorize and @PostAuthorize

2. If you are using java configuration , you need to check if your java configuration class is annotated with

@EnableGlobalMethodSecurity(securedEnabled=true, prePostEnabled=true)

securedEnabled is for @Secured and prePostEnabled attribute is for @PreAuthorize and @PostAuthorize

Amardeep

Replied on May 20, 2015

Great its working now. I am using java configuration and I was missing

@EnableGlobalMethodSecurity(securedEnabled=true, prePostEnabled=true) annotation

on my java configuration.

Mohit

Replied on May 20, 2015

Follow the links for the reference.

XML based:

http://www.concretepage.com/spring/spring-security/preauthorize-postauthorize-in-spring-security

Java config based:

http://www.concretepage.com/spring-4/spring-4-security-junit-test-with-withmockuser-and-withuserdetails-annotation-example-using-webappconfiguration