title: Spring Security method authorization not working
body: <p>here is the description of problem. I am develepping a web application with GWT. I have successfullly integrate spring security with gwt for the authentication feature with the following code. Now I want to use the spring "method security" in my web application. So I did what it says in <a href="http://static.springsource.org/spring-security/site/docs/3.1.x/reference/ns-config.html" rel="nofollow">http://static.springsource.org/spring-security/site/docs/3.1.x/reference/ns-config.html</a>,</p>
  
  <ul>
  <li><p>just adding <code>&lt;global-method-security secured-annotations="enabled"/&gt;</code> in the above mentionned application context file.</p>
  
  <pre><code> &lt;http&gt;
    &lt;http-basic/&gt;
  
    &lt;intercept-url pattern="/**" access=""/&gt;
  
    &lt;form-login /&gt;
    &lt;logout /&gt;
   &lt;/http&gt; 
  
    &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
        &lt;user-service&gt;
          &lt;user name="jimis" password="jimispassword" authorities="ROLE_USER,ROLE_ADMIN" /&gt;
          &lt;user name="bob" password="bobspassword" authorities="ROLE_ADMIN" /&gt;
        &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
    &lt;/authentication-manager&gt;
  
    **&lt;global-method-security secured-annotations="enabled"/&gt;** 
  </code></pre></li>
  <li><p>then adding the annotation @Secured("ROLE_ADMIN") above the function that I what to controle the access</p></li>
  </ul>
  
  <p>Then I add the declaration of application context in the web.xml as following:</p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
                http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
           version="2.5"
           xmlns="http://java.sun.com/xml/ns/javaee"&gt;
  
   &lt;!-- Default page to serve --&gt;
  
    &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;App.html&lt;/welcome-file&gt;
    &lt;/welcome-file-list&gt;
    &lt;session-config&gt;
      &lt;session-timeout&gt;10&lt;/session-timeout&gt; &lt;!-- in minutes --&gt;
    &lt;/session-config&gt;
  </code></pre>
  
  <blockquote>
  <pre><code>&lt;context-param&gt;
    &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
    &lt;param-value&gt;
        /WEB-INF/applicationContext-security.xml
    &lt;/param-value&gt;
    &lt;/context-param&gt;
  
    &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
    &lt;/filter&gt;
  
    &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  
    &lt;listener&gt;
        &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
    &lt;/listener&gt;
  </code></pre>
  </blockquote>
  
  <pre><code>  &lt;servlet&gt;
      &lt;servlet-name&gt;appService&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.google.gwt.app.example.server.AppServiceImpl&lt;/servlet-class&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
       &lt;servlet-name&gt;appService&lt;/servlet-name&gt;
       &lt;url-pattern&gt;/app/appService.rpc&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Note that I've just declared the gwt-servlet not the spring dispatcher servlet.</p>
  
  <p>However it seems that this configuration doesn't work. In fact, whatever role can have the authority to access the function. 
  Very Strange.
  Hope your answers!</p>