title: hasRole always return 403
body: <p>I can't seem to get my security configuration right. No matter what I do when using <code>hasRole</code> my endpoints always return 403.</p>
  
  <p>Also I can't get anything to work unless I duplicate my <code>antMatchers</code> under both <code>.requestMatchers()</code> and <code>.authorizeRequests()</code>. I'm clearly missing something here.</p>
  
  <p>Basically I want everything to require authentication but a few endpoints only to be accessable if the user is member of certain groups (for now just admin).</p>
  
  <p>My security configuration is as follows. Everything beside <code>hasRole</code> works.</p>
  
  <pre class="lang-java prettyprint-override"><code>@EnableGlobalMethodSecurity(prePostEnabled = true)
  @EnableWebSecurity
  @Configuration
  public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf().disable()
              .requestMatchers()
                  .antMatchers(HttpMethod.GET, "/v2/api-docs", "/swagger-resources/**", "/swagger-ui.html")
                  .antMatchers(HttpMethod.GET, "/users")
                  .and()
              .authorizeRequests()
                  .antMatchers(HttpMethod.GET, "/v2/api-docs", "/swagger-resources/**", "/swagger-ui.html").permitAll()
                  .antMatchers(HttpMethod.GET, "/users").hasRole("ADMIN")    
                  .anyRequest().authenticated();
      }
  
      // Inspiration: https://spring.io/blog/2015/06/08/cors-support-in-spring-framework#comment-2416096114
      @Override
      public void configure(WebSecurity web) throws Exception {
          web
              .ignoring()
                  .antMatchers(HttpMethod.OPTIONS, "/**");
      }
  }
  </code></pre>
  
  <p>My AuthenticationConfiguration is as follows</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  public class AuthenticationConfiguration extends GlobalAuthenticationConfigurerAdapter {
      private final UserDetailsService userService;
      private final PasswordEncoder passwordEncoder;
  
      public AuthenticationConfiguration(UserDetailsService userService, PasswordEncoder passwordEncoder) {
          this.userService = userService;
          this.passwordEncoder = passwordEncoder;
      }
  
      @Override
      public void init(AuthenticationManagerBuilder auth) throws Exception {
          auth
                  .userDetailsService(userService)
                  .passwordEncoder(passwordEncoder);
      }
  }
  </code></pre>
  
  <p>My AuthorizationServerConfiguration is as follows</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthorizationServerConfiguration extends AuthorizationServerConfigurerAdapter {
      private final AuthenticationManager authenticationManager;
  
      public AuthorizationServerConfiguration(AuthenticationManager authenticationManager) {
          this.authenticationManager = authenticationManager;
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(authenticationManager);
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients
                  .inMemory()
                  .withClient("html5")
                  .secret("password")
                  .authorizedGrantTypes("password")
                  .scopes("openid");
      }
  }
  </code></pre>
  
  <p>I'll happily post my user service and other stuff. But everything seems to work beside <code>hasRole</code> and <code>Principal</code> is loaded with the right authorities (roles). But please let me know if I should post any more code.</p>
  
  <p>The entire source code can be found <a href="https://github.com/tonsV2/MyBiz2" rel="noreferrer">here</a>.</p>