java - Spring security with Hibernate and Annotations and basic HTTP authentication -

after studying many examples, can't find example shows how create spring security configurations, while roles listed in annotations , hibernate used authentication.

my files:

mvc-dispather-servlet.xml:

<beans xmlns="http://www.springframework.org/schema/beans"    xmlns:context="http://www.springframework.org/schema/context"    xmlns:mvc="http://www.springframework.org/schema/mvc"    xmlns:security="http://www.springframework.org/schema/security"    xmlns:xsi="http://www.w3.org/2001/xmlschema-instance"    xsi:schemalocation="     http://www.springframework.org/schema/beans     http://www.springframework.org/schema/beans/spring-beans-3.0.xsd     http://www.springframework.org/schema/context     http://www.springframework.org/schema/context/spring-context-3.0.xsd     http://www.springframework.org/schema/mvc     http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd     http://www.springframework.org/schema/security     http://www.springframework.org/schema/security/spring-security-3.1.xsd">     <import resource="classpath:hibernate-beans.xml" />      <mvc:annotation-driven/>     <context:annotation-config/>     <context:component-scan base-package="com.salespredict"/>  </beans> 

spring-security.xml:

<beans:beans xmlns="http://www.springframework.org/schema/security"          xmlns:beans="http://www.springframework.org/schema/beans"          xmlns:security="http://www.springframework.org/schema/security"          xmlns:xsi="http://www.w3.org/2001/xmlschema-instance"          xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">  <http>      <http-basic/> </http>  <authentication-manager alias="authenticationmanager">     <authentication-provider user-service-ref="authenticationservice" /> </authentication-manager>  <global-method-security secured-annotations="enabled" />  </beans:beans> 

service:

@service public class authenticationservice implements userdetailsservice {

@autowired private iuserrepository userrepository;  @override public userdetails loaduserbyusername(string username) throws usernamenotfoundexception {     user user = userrepository.findone(username);     set<role> roles = user.getroles();     set<grantedauthority> authorities = new hashset<>();     for(role role:roles) {         authorities.add(new simplegrantedauthority(role.getrole().name()));     }     return new org.springframework.security.core.userdetails.user(             user.getusername(),             user.getpassword(),             authorities); } 

}

controller:

@controller @secured({rolenames.admin, rolenames.sales_predict_admin}) @requestmapping("/admin") public class admin extends webservicebase {       @requestmapping(value = "/users", method = requestmethod.put, produces = "application/json", consumes = "application/json")     public     @responsebody     responseentity registernewusers(inputstream data) throws exception {         // deserialize json         users users = _mapper.readvalue(data, users.class);         putusers msg = new putusers(users.getusers());         postmessage(msg, defaultresponse.class);         return ok();      }     ...     } 

if change <http> to

 <http use-expressions="true">     <intercept-url pattern="/**" access="isauthenticated()" />     <http-basic /> </http> 

then authentication service called, checks whether user provides password, not check roles. if remove it, authentication servic not called @ all.

what should write in <intercept-url pattern="/**" access= ... > make checking roles @secured annotation?

try move your

<global-method-security secured-annotations="enabled" /> 

declaration mvc-dispather-servlet.xml because admin controller picked mvc-dispather-servlet.xml , not spring-security.xml. see corresponding faq entry.