title: Spring Security 4. Exception when specifying access decision manager
body: <p>I am using Spring Security 4 in my Java project. When I specify tag access-decision-manager-ref in http element I have this exception:</p>
  
  <blockquote>
    <p>org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#0' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#0': Cannot resolve reference to bean 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0' while setting constructor argument with key [13]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0': Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: Unsupported configuration attributes: [hasRole('ADMIN')]</p>
  </blockquote>
  
  <p>Here is my xml configuration file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:security="http://www.springframework.org/schema/security"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  &lt;security:http auto-config="true" access-decision-manager-ref="accessDecisionManager"
       use-expressions="true"&gt;
      &lt;security:intercept-url pattern="/admin/*"
          access="hasRole('ADMIN')" /&gt;
      &lt;security:remember-me key="terror-key" /&gt;
      &lt;security:logout delete-cookies="JSESSIONID"
          success-handler-ref="logoutRedirectToAny" /&gt;
      &lt;security:form-login login-page="/custom_login"
          authentication-failure-handler-ref="serverErrorHandler" /&gt;
  &lt;/security:http&gt;
  
  &lt;bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.access.vote.RoleVoter" /&gt;
              &lt;bean class="org.springframework.security.access.vote.AuthenticatedVoter" /&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider
          user-service-ref="inMemoryUserServiceWithCustomUser" /&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="inMemoryUserServiceWithCustomUser"
      class="com.apress.pss.terrormovies.spring.CustomInMemoryUserDetailsManager"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="com.apress.pss.terrormovies.model.User"&gt;
                  &lt;constructor-arg value="admin" /&gt;
                  &lt;constructor-arg value="admin" /&gt;
                  &lt;constructor-arg&gt;
                      &lt;list&gt;
                          &lt;bean
                              class="org.springframework.security.core.authority.SimpleGrantedAuthority"&gt;
                              &lt;constructor-arg value="ROLE_ADMIN" /&gt;
                          &lt;/bean&gt;
                      &lt;/list&gt;
                  &lt;/constructor-arg&gt;
                  &lt;constructor-arg value="Scarioni" /&gt;
              &lt;/bean&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="logoutRedirectToAny"
      class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler"&gt;
      &lt;property name="targetUrlParameter" value="redirectTo" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="serverErrorHandler" class="com.apress.pss.terrormovies.security.ServerErrorFailureHandler"/&gt;
  
  &lt;/beans&gt;
  </code></pre>