title: denying access for multiple users of same role in spring security
body: <p>I've run into a such situation: my application has several roles(administrator, moderator, user). Moderator and User can edit some forms. All permisions are ok. But when I'm loggen in as a user(role User) and change an id in the url, I can simply get and edit form of another user(role User).</p>
  
  <p>How to deny access and prevent such actions?</p>
  
  <p>ps. version of spring and spring security is 3.1.2</p>
  
  <p>update - added spring security context</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
                      http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                      http://www.springframework.org/schema/security
                      http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
      &lt;http use-expressions="true" auto-config="false"
          entry-point-ref="authenticationEntryPoint" access-denied-page="/403.jsp"&gt;
          &lt;form-login login-page="/login.html"
              authentication-failure-url="/login.html?error=true"
              login-processing-url="/j_spring_security_check"
              authentication-success-handler-ref="successHandler" /&gt;
          &lt;logout logout-url="/logout" logout-success-url="/login.html" /&gt;
          &lt;intercept-url pattern="/admin/**" access="hasRole('adminViewPermission')" /&gt;
          &lt;intercept-url pattern="/moderator/**" access="hasRole('moderatorViewPermission')" /&gt;
  
          &lt;intercept-url pattern="**/form-management"
              access="hasRole('formManagementPermission')" /&gt;
  
      &lt;/http&gt;
  
  
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider user-service-ref="userDetailsService" /&gt;
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean id="authenticationEntryPoint"
          class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
          &lt;beans:property name="loginFormUrl" value="/login.html" /&gt;
          &lt;beans:property name="forceHttps" value="false" /&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="successHandler"
          class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"&gt;
          &lt;beans:property name="defaultTargetUrl" value="/authenticate" /&gt;
          &lt;beans:property name="alwaysUseDefaultTargetUrl" value="true"/&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="userDetailsService"
          class="com.jack.MyYserDetailsService"&gt;
      &lt;/beans:bean&gt;
  &lt;/beans:beans&gt;
  </code></pre>