title: Spring Security - 'global-method-security' does not work
body: <p>I am a newbie regarding Spring &amp; Spring Security Frameworks and trying to secure a Java EE 7 REST App running on latest stable Glassfish build using Spring Security v3.1.4. </p>
  
  <p>Everything is fine but <strong>i cannot manage to make 'global-method-security' work</strong>! Here are my configs, any help would be greatly appreciated.</p>
  
  <p>web.xml:</p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          /WEB-INF/spring/*.xml
      &lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;filterChainProxy&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;filterChainProxy&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;    
  </code></pre>
  
  <p>Spring application context is configured for pre-authentication and looks like:</p>
  
  <pre><code>&lt;bean class="org.springframework.context.annotation.CommonAnnotationBeanPostProcessor"&gt;
          &lt;property name="alwaysUseJndiLookup" value="true" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"&gt;
          &lt;sec:filter-chain-map request-matcher="ant"&gt;
              &lt;sec:filter-chain pattern="/api/authentication" filters="none"/&gt;
              &lt;sec:filter-chain pattern="/**" filters="sif,requestHeaderAuthFilder,logoutFilter,etf,fsi"/&gt;
          &lt;/sec:filter-chain-map&gt;
      &lt;/bean&gt;
  
      &lt;bean id="sif" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"/&gt;
  
      &lt;sec:authentication-manager alias="authenticationManager"&gt;
          &lt;sec:authentication-provider ref='preAuthenticatedAuthenticationProvider'/&gt;
      &lt;/sec:authentication-manager&gt;
  
      &lt;bean id="preAuthenticatedAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
          &lt;property name="preAuthenticatedUserDetailsService"&gt;
              &lt;bean id="userDetailsServiceWrapper"
                    class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"&gt;
                  &lt;property name="userDetailsService" ref="preAuthenticatedUserDetailsService"/&gt;
              &lt;/bean&gt;         
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="preAuthenticatedUserDetailsService"
            class="org.someUserDetailsService"/&gt;
  
      &lt;bean id="requestHeaderAuthFilder" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;property name="principalRequestHeader" value="sometoken"/&gt;      
      &lt;/bean&gt;
  
      &lt;bean id="preAuthenticatedProcessingFilterEntryPoint"
            class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/&gt;
  
      &lt;bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
          &lt;constructor-arg value="/"/&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;bean id="servletContext" class="org.springframework.web.context.support.ServletContextFactoryBean"/&gt;
  
      &lt;bean id="etf" class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
          &lt;property name="authenticationEntryPoint" ref="preAuthenticatedProcessingFilterEntryPoint"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="httpRequestAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"&gt;
          &lt;property name="allowIfAllAbstainDecisions" value="false"/&gt;
          &lt;property name="decisionVoters"&gt;
              &lt;list&gt;
                  &lt;ref bean="roleVoter"/&gt;
                  &lt;ref bean="authenticatedVoter"/&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;bean id="fsi" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
          &lt;property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/&gt;      
          &lt;property name="securityMetadataSource"&gt;
              &lt;sec:filter-security-metadata-source use-expressions="true"&gt;
                  &lt;!--&lt;sec:intercept-url  pattern="/api/authentication" access="permitAll"/&gt;--&gt;
                  &lt;sec:intercept-url pattern="/**" access="isAuthenticated()"/&gt;
              &lt;/sec:filter-security-metadata-source&gt;
          &lt;/property&gt;
  
      &lt;/bean&gt;
  
      &lt;bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"/&gt;
      &lt;bean id="authenticatedVoter" class="org.springframework.security.web.access.expression.WebExpressionVoter"/&gt;
  
      &lt;bean id="securityContextHolderAwareRequestFilter" class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter"/&gt;  
  </code></pre>
  
  <p>And following is the Spring ACL Configuration:</p>
  
  <pre><code>&lt;sec:global-method-security             
          pre-post-annotations="enabled"&gt;
          &lt;sec:expression-handler ref="expressionHandler" /&gt;
       &lt;/sec:global-method-security&gt;
  
  
      &lt;bean id="expressionHandler"             class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"&gt;
          &lt;property name="permissionEvaluator" ref="aclPermissionEvaluator" /&gt;
      &lt;/bean&gt;
  
      &lt;bean name="aclPermissionEvaluator"
            class="org.CustomPermissionEvaluator"&gt;
          &lt;constructor-arg name="aclService" ref="aclService" /&gt;
          &lt;property name="sidRetrievalStrategy" ref="someSidRetrievalStrategy" /&gt;
      &lt;/bean&gt;   
  
      &lt;bean id="lookupStrategy"
            class="org.springframework.security.acls.jdbc.BasicLookupStrategy"&gt;
          &lt;constructor-arg name="dataSource" ref="dataSource" /&gt;
          &lt;constructor-arg name="aclCache" ref="aclCache" /&gt;
          &lt;constructor-arg name="aclAuthorizationStrategy" ref="aclAuthorizationStrategy" /&gt;
          &lt;constructor-arg name="auditLogger" ref="auditLogger" /&gt;
      &lt;/bean&gt;
  
       &lt;bean id="aclCache"
            class="org.springframework.security.acls.domain.EhCacheBasedAclCache"&gt;
          &lt;constructor-arg&gt;
              &lt;bean class="org.springframework.cache.ehcache.EhCacheFactoryBean"&gt;
                  &lt;property name="cacheManager"&gt;
                      &lt;bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" /&gt;
                  &lt;/property&gt;
                  &lt;property name="cacheName" value="aclCache" /&gt;
              &lt;/bean&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;bean id="aclAuthorizationStrategy"
            class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl"&gt;
          &lt;constructor-arg name="auths"&gt;
              &lt;list&gt;
                  &lt;!-- authority for taking ownership --&gt;
                  &lt;bean
                      class="org.springframework.security.core.authority.GrantedAuthorityImpl"&gt;
                      &lt;constructor-arg value="ROLE_ADMIN" /&gt;
                  &lt;/bean&gt;
                  &lt;!-- authority to modify auditing --&gt;
                  &lt;bean
                      class="org.springframework.security.core.authority.GrantedAuthorityImpl"&gt;
                      &lt;constructor-arg value="ROLE_ADMIN" /&gt;
                  &lt;/bean&gt;
                  &lt;!-- authority to make general changes --&gt;
                  &lt;bean
                      class="org.springframework.security.core.authority.GrantedAuthorityImpl"&gt;
                      &lt;constructor-arg value="ROLE_ADMIN" /&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
          &lt;property name="sidRetrievalStrategy" ref="someSidRetrievalStrategy"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="someSidRetrievalStrategy" class="org.SomeSidRetrievalStrategyImpl"/&gt;
  
      &lt;bean id="auditLogger"
            class="org.springframework.security.acls.domain.ConsoleAuditLogger" /&gt;
  
  
      &lt;jee:jndi-lookup 
          id="dataSource" 
          jndi-name="springacl" /&gt; 
  
  
      &lt;bean id="aclService" name="aclService"
            class="org.springframework.security.acls.jdbc.JdbcMutableAclService"&gt;
          &lt;constructor-arg name="dataSource" ref="dataSource" /&gt;
          &lt;constructor-arg name="lookupStrategy" ref="lookupStrategy" /&gt;
          &lt;constructor-arg name="aclCache" ref="aclCache" /&gt;
          &lt;property name="sidIdentityQuery" value="select currval(pg_get_serial_sequence('acl_sid', 'id'))" /&gt;
          &lt;property name="classIdentityQuery" value="select currval(pg_get_serial_sequence('acl_class', 'id'))" /&gt;
      &lt;/bean&gt;
  </code></pre>
  
  <p>And the method i want to apply permission check looks like:</p>
  
  <pre><code>    @GET
      @Path("/{id}")
      @Produces(MediaType.APPLICATION_JSON)
      @PreAuthorize("hasPermission(#id, 'read')")
      public Project getProject(@PathParam("id") Long id) {
      }
  </code></pre>
  
  <p><br>
  <strong>Where do i make things wrong?</strong></p>