title: Custom permissions in Spring Security - targetId null
body: <p>I'm securing my Application with expression based Spring Security 3.x. I have the following service interface:</p>
  
  <pre><code>@PreAuthorize("hasRole('ROLE_ADMIN') or hasPermission(#employeeId, 'employee', 'isOwner')")
  EmployeeData getById(Integer employeeId);
  
  @PreAuthorize("hasRole('ROLE_ADMIN') or hasPermission(#employeeId, 'employee', 'isOwner')")
  void update(Integer employeeId, EmployeeData employeedata);
  </code></pre>
  
  <p>My PermissionEvaluator looks as follows:</p>
  
  <pre><code>@Component
  public class CustomPermissionEvaluator implements PermissionEvaluator {
      private Map&lt;String, Permission&gt; permissionMap = new HashMap&lt;String, Permission&gt;();
  
      public CustomPermissionEvaluator(Map&lt;String, Permission&gt; permissionMap) {
          this.permissionMap = permissionMap;
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
          throw new PermissionNotDefinedException("Permission not supported for loaded domain object by " + this.getClass().toString());
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
          verifyPermissionIsDefined((String) permission);
          return permissionMap.get(permission).isAllowed(authentication, (Integer) targetId);
      }
  
      private void verifyPermissionIsDefined(String permissionKey) {
          if (!permissionMap.containsKey(permissionKey)) {
              throw new PermissionNotDefinedException("No permission with key '" + permissionKey + "' is defined in" + this.getClass().toString());
          }
      }
  }
  </code></pre>
  
  <p>For the first service method (getById) this works as it's supposed to:</p>
  
  <ul>
  <li>If the user has the ROLE_ADMIN, then he's allowed to get the data.</li>
  <li>If the user wants to look up his own profile, he's allowed as well</li>
  </ul>
  
  <p>But, for the second method, the update method, the application doesn't work. The targetId is always null, when it invokes the method <code>hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission)</code>.</p>
  
  <p>I can't figure out why. Any help would be appreciated.</p>