Spring security 4 @PreAuthorize(hasAuthority()) access denied

Question

I am trying to convert a Spring Security 3 @Secured("admin") annotation into Spring Security 4 compatible fashion.

This is my usersService.java

@PreAuthorize("hasAuthority('admin')")
public List<User> getAllUsers() {
    return usersDao.getAllUsers();
}

Then in security-context.xml I have:

<security:intercept-url pattern="/admin" access="permitAll" />
...
<security:global-method-security pre-post-annotations="enabled" />

getAllUsers() is called by a LoginController.java

@RequestMapping("/admin")
public String showAdmin(Model model) {
    List<User> users = usersService.getAllUsers();

    model.addAttribute("users", users);

    return "admin";
}

In mySql database, there are two tables, users and authorities. authorities has 2 columns, username and authority. administrator has authority admin.

Now if I trie to access /admin, I will be redirected to /login, but after I log in with administrator, I still get "access denied".

I think I must have missed something very basic but as I am new to Spring, I could not figure it out. Any help would be appreciated. Thanks.

Update: I tried changing the annotation to @PreAuthorize("hasRole('ROLE_ADMIN')") and I also changed the "authority" column in mySql for admin from "admin" to "ROLE_ADMIN" but it still gives me 403. I did not have much faith on this because before this error, I had to change hasRole('admin') in securityContext.xml to hasAuthority('admin').

score 20 · Answer 1 · answered Sep 13 '17 at 13:46

20

Although it's late, nevertheless

hasRole(...) set a prefix for the the content - the default one is ROLE_

hasAuthority(...) checks the content WITHOUT a prefix, i.e. just the pure content

answered Sep 13 '17 at 13:46

LeO

4,238
4
48
88

Unfortunately, I am no longer working on this project. Thanks for the input, though. – ericcire Sep 14 '17 at 22:18
I had the same issue (although I wasn't trying to migrate between versions) in which the authority wasn't working and this answer solved it. But I also had to add the annotation suggested by @Sohil – Ernani Oct 28 '19 at 18:58

score 4 · Answer 2 · edited Sep 20 '19 at 11:16

4

You should add in Spring security

@EnableGlobalMethodSecurity(prePostEnabled = true)

edited Sep 20 '19 at 11:16

Suraj Rao

29,388
11
94
103

answered Sep 20 '19 at 11:06

Самир Шахмурадлы

775
2
11
23

score 2 · Answer 3 · answered Sep 05 '16 at 04:37

2

Try this @PreAuthorize("hasRole('ROLE_ADMIN')")

answered Sep 05 '16 at 04:37

Sohil

532
7
26

No, it doesn't work. I will update my question with a few details. – ericcire Sep 05 '16 at 23:23

Spring security 4 @PreAuthorize(hasAuthority()) access denied

3 Answers3