title: Spring Security Role Hierarchy not working using Java Config
body: <p>First of all, I am new to Java Spring Framework. So forgive me if I did not provide enough info. I have tried to add RoleHierarchy into my app but it did not work. Below are the codes I have tried.</p>
  
  <hr>
  
  <p><strong>SecurityConfig.java</strong></p>
  
  <pre><code>// These config is try to set up a user Role Hierarchy
  @Bean
  public RoleHierarchy roleHierarchy() {
    System.out.println("arrive public RoleHierarchy roleHierarchy()");
    RoleHierarchyImpl r = new RoleHierarchyImpl();
    r.setHierarchy("ROLE_ADMIN &gt; ROLE_STAFF");
    r.setHierarchy("ROLE_STAFF &gt; ROLE_USER");
    r.setHierarchy("ROLE_DEVELOPER &gt; ROLE_USER");
    r.setHierarchy("ROLE_USER &gt; ROLE_GUEST"); 
    return r;
  }
  
  @Bean
  public AffirmativeBased defaultAccessDecisionManager(RoleHierarchy roleHierarchy){
    System.out.println("arrive public AffirmativeBased defaultAccessDecisionManager()");
    List&lt;AccessDecisionVoter&gt; decisionVoters = new ArrayList&lt;&gt;();
  
    // webExpressionVoter
    WebExpressionVoter webExpressionVoter = new WebExpressionVoter();
    DefaultWebSecurityExpressionHandler
        expressionHandler = new DefaultWebSecurityExpressionHandler();
    expressionHandler.setRoleHierarchy(roleHierarchy);
    webExpressionVoter.setExpressionHandler(expressionHandler);
  
    decisionVoters.add(webExpressionVoter);
    decisionVoters.add(roleHierarchyVoter(roleHierarchy));
    // return new AffirmativeBased(Arrays.asList((AccessDecisionVoter) webExpressionVoter));
    return new AffirmativeBased(decisionVoters);
  }
  
  @Bean
  public RoleHierarchyVoter roleHierarchyVoter(RoleHierarchy roleHierarchy) {
    System.out.println("arrive public RoleHierarchyVoter roleHierarchyVoter");
    return new RoleHierarchyVoter(roleHierarchy);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    // skipping some codes
    http
      // skipping some codes
      .accessDecisionManager(defaultAccessDecisionManager(roleHierarchy()))
    // skipping some codes
  }
  </code></pre>
  
  <hr>
  
  <p><strong>MethodSecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
  public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
  
    @Inject
    private SecurityConfig securityConfig;
  
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
      return securityConfig.authenticationManagerBean();
    }
  
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
      System.out.println("arrive protected MethodSecurityExpressionHandler createExpressionHandler()");
      DefaultMethodSecurityExpressionHandler d = new DefaultMethodSecurityExpressionHandler();
      d.setRoleHierarchy(securityConfig.roleHierarchy());
      return d;
    }
  
  }
  </code></pre>
  
  <hr>
  
  <p>And I have a <code>UserDetailsServiceImpl implements UserDetailsService</code> that provide the <code>principal</code>, <code>Authentication</code> and <code>GrantedAuthority</code></p>
  
  <p>Finally I have some APIs:</p>
  
  <pre><code>@PreAuthorize("hasRole('ROLE_STAFF')")
  @RequestMapping(value = "/api/v1/contactUs", method = RequestMethod.GET)
  
  @PreAuthorize("hasRole('ROLE_DEVELOPER')")
  @RequestMapping(value = "/api/v1/system", method = RequestMethod.GET)
  </code></pre>
  
  <hr>
  
  <p>The problem is now if I login as ROLE_STAFF, ROLE_DEVELOPER, ROLE_ADMIN, I got the following result.</p>
  
  <pre><code>| API       | ROLE_STAFF | ROLE_DEVELOPER | ROLE_ADMIN |
  |-----------|------------|----------------|------------|
  | contactUs | 200        | 403            | 403        |
  | system    | 403        | 200            | 403        |
  </code></pre>
  
  <p>As you can see <code>ROLE_STAFF</code> and <code>ROLE_DEVELOPER</code> work just fine. But I want <code>ROLE_ADMIN</code> as a super role of both and it didn't work. </p>
  
  <p>FYI, I am using spring-security 3.2.5.RELEASE</p>