title: Can not get @EnableGlobalMethodSecurity working
body: <p>I'm trying to configure <code>@EnableGlobalMethodSecurity</code> on a java based configuration, but the methods being annotated are being ignored by the aspect. I've covered all the problems usually encountered with the same XML config, my annotation is on a security configuration part of the root context, and my service classes are also managed under the root context.</p>
  
  <p>In the following <code>TestService</code> is an interface containing my <code>@PreAuthorize</code> annotation which I also have a corresponding implementation that I have also tried annotating directly.</p>
  
  <p><strong>AppInitializer.java</strong></p>
  
  <pre><code>public class AppInitializer
          extends AbstractAnnotationConfigDispatcherServletInitializer {
  
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {
          return new Class[]{
              RootConfig.class,
              SecurityConfig.class
          };
      }
  
      @Override
      protected Class&lt;?&gt;[] getServletConfigClasses() {
          return new Class[]{WebConfig.class};
      }
  
      @Override
      protected String[] getServletMappings() {
          return new String[]{"/"};
      }
  
  }
  </code></pre>
  
  <p><strong>RootConfig.java</strong></p>
  
  <pre><code>@Configuration
  @ComponentScan(basePackages = {"com.acme.app.service"})
  public class RootConfig {
  }
  </code></pre>
  
  <p><strong>SecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
  public class SecurityConfig {
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth)
              throws Exception {
          auth.inMemoryAuthentication()
              .withUser("user").password("password").roles("USER").and()
              .withUser("admin").password("pass").roles("USER", "ADMIN");
      }
  
      @Configuration
      public static class FormLoginWebSecurityConfigurerAdapter
              extends WebSecurityConfigurerAdapter {
          @Autowired
          UserDetailsService userDetailsService;
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.authorizeRequests()
                  .antMatchers("/").permitAll()
                  .antMatchers("/static/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
                  .formLogin()
                  .loginPage("/login").permitAll().defaultSuccessUrl("/")
                  .and().logout().logoutUrl("/logout")
                  .logoutSuccessUrl("/");
          }
          @Override
          protected UserDetailsService userDetailsService() {
              return userDetailsService;
          }
      }
  
      @Bean
      public UserDetailsService userDetailsServiceBeanCreation() {
          Collection&lt;UserDetails&gt; users = new ArrayList&lt;&gt;();
          users.add(getUser("user", "password", "USER"));
          users.add(getUser("admin", "pass", "ADMIN", "USER"));
          UserDetailsService uds = new InMemoryUserDetailsManager(users);
          return uds;
      }
  
      private UserDetails getUser(String user, String pass, String... roles) {
          // impl omitted...
      }
  
      @Configuration
      @Order(1)
      public static class ApiWebSecurityConfigurationAdapter
              extends WebSecurityConfigurerAdapter {
          @Autowired
          UserDetailsService userDetailsService;
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.antMatcher("/api/**")
                  .authorizeRequests()
                  .anyRequest().authenticated()
                  .and()
                  .httpBasic().realmName("com.acme.app")
                  .and().sessionManagement();
          }
          @Override
          protected UserDetailsService userDetailsService() {
              return userDetailsService;
          }
      }
  }
  </code></pre>
  
  <p><strong>WebConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  @ComponentScan(basePackages = {"com.acme.app.config",
                                 "com.acme.app.controllers"},
                 excludeFilters = {
                     @Filter(type = ASSIGNABLE_TYPE,
                             value = {
                                 WebConfig.class,
                                 SecurityConfig.class
                             })
                 })
  public class WebConfig extends WebMvcConfigurerAdapter {
  
      @Override
      public void addResourceHandlers(ResourceHandlerRegistry registry) {
          registry.addResourceHandler("/static/**")
                  .addResourceLocations("/static/");
      }
  
      @Bean
      public CookieLocaleResolver getLocaleResolver() {
          CookieLocaleResolver bean = new CookieLocaleResolver();
          bean.setCookieName("clientlanguage");
          bean.setCookieMaxAge(100000);
          return bean;
      }
  
      @Override
      public void addInterceptors(InterceptorRegistry registry) {
          LocaleChangeInterceptor lci = new LocaleChangeInterceptor();
          lci.setParamName("lang");
          registry.addInterceptor(lci);
      }
  
      @Bean
      public TilesConfigurer getTilesConfigurer() {
          CustomTilesInitializer ti = new CustomTilesInitializer();
          TilesConfigurer res = new TilesConfigurer();
          res.setCompleteAutoload(true);
          res.setDefinitions("/WEB-INF/**/tiles.xml");
          return res;
      }
  
      @Override
      public void configureViewResolvers(ViewResolverRegistry registry) {
          registry.tiles();
          registry.enableContentNegotiation(new MappingJackson2JsonView());
      }
  
      @Override
      public void addViewControllers(ViewControllerRegistry registry) {
          registry.addViewController("/").setViewName("home");
          registry.addRedirectViewController("/home", "/");
          registry.addViewController("/login").setViewName("login");
          registry.addViewController("/aboutme").setViewName("aboutme");
      }
  
  }
  </code></pre>
  
  <p><strong>TestService.java</strong></p>
  
  <pre><code>public interface TestService {
      @PreAuthorize("hasAuthority('ROLE_DUMMY_ROLE')")
      BasicData getDataSecured();
  }
  </code></pre>
  
  <p>Note that I also have spring-aop in my pom.</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;dependency&gt;
    &lt;groupId&gt;org.springframework&lt;/groupId&gt;
    &lt;artifactId&gt;spring-aop&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>