title: How to set user role in Spring Security 3?
body: <p>I am working on JAVA EE technologies to learn JSF-Spring-Hibernate vs...
  I am trying to do web application with diffirent user roles. Now, I have only one user role ROLE_USER. I could not change that role. I tried debug mod to understand how we set this role but I could not understand where it is happening.</p>
  
  <p>So, my main problem is I can not create any other ROLE in my application. If I do not use <code>&lt;secured attributes="ROLE_USER" /&gt;</code> in my flow (I am using spring web-flow) everyone can reach that page. If I do only ROLE_USER. But I want to create new role named ROLE_ADMIN and only let ROLE_ADMIN to reach that page.  </p>
  
  <p>NOTE: I did not add all files here cause is spoken to me that only add related classes and files. If you need extra information please let me know.</p>
  
  <p>This is the tutorial soruce code that I am following.
  <a href="https://code.google.com/p/jee-tutorial-youtube/source/browse/" rel="nofollow noreferrer">https://code.google.com/p/jee-tutorial-youtube/source/browse/</a></p>
  
  <p>security-config.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  </code></pre>
  
  <p>
  
  <pre><code>&lt;security:http auto-config="true"&gt;
      &lt;security:form-login login-page="/app/main"
          default-target-url="/app/account" /&gt;
      &lt;security:logout logout-url="/app/logout"
          logout-success-url="/app/main" /&gt;
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider
          user-service-ref="userServiceImp"&gt;
          &lt;security:password-encoder hash="md5" /&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="daoAuthenticationProvider"
      class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;property name="userDetailsService" ref="userServiceImp" /&gt;
      &lt;property name="hideUserNotFoundExceptions" value="false" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="authenticationManager"
      class="org.springframework.security.authentication.ProviderManager"&gt;
      &lt;constructor-arg&gt;
          &lt;ref bean="daoAuthenticationProvider" /&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p></p>
  
  <p>This is my UserAuthenticationProviderServiceImp class where I authenticatethe the user.</p>
  
  <pre><code> public boolean processUserAuthentication(Users user) {
  
          try {
                  Authentication request = new UsernamePasswordAuthenticationToken(user.getUserName(), user.getPassword());
                  Authentication result = authenticationManager.authenticate(request);
                  SecurityContextHolder.getContext().setAuthentication(result);
  
                  return true;
          } catch(AuthenticationException e) {
                  FacesContext.getCurrentInstance().addMessage(null, 
                                  new FacesMessage(FacesMessage.SEVERITY_ERROR, e.getMessage(), "Sorry!"));
  
                  return false;
          }
  }
  </code></pre>
  
  <p>And I figure out that this function, im my Service class, is called in processUserAuthentication.Then I thought this is the function where Roles are setted.</p>
  
  <pre><code>public UserDetails loadUserByUsername(String userName)
          throws UsernameNotFoundException {
  
      Users user = userDao.loadUserByUserName(userName);
  
      if (user == null) {
          throw new UsernameNotFoundException(String.format(
                  getMessageBundle().getString("badCredentials"), userName));
      }
  
      Collection&lt;GrantedAuthority&gt; authorities = new ArrayList&lt;GrantedAuthority&gt;();
      authorities.add(new SimpleGrantedAuthority("USER_ROLE"));
      User userDetails = new User(user.getUserName(), user.getPassword(),
              authorities);
      return userDetails;
  }
  </code></pre>
  
  <p>Update:</p>
  
  <p>In my project I have to use this syntax to create roles: ROLE_X where x is any string. Example; we can have ROLE_MYNAME but we can not have juts MYNAME or MYNAME_ROLE as role. It has to start with ROLE_. I am still trying to find what couses this problem. I will update If I found any answer.</p>
  
  <p>EDIT:
  There is an detailed explanation why we has to use ROLE_ in this page;
  <a href="http://bluefoot.info/howtos/spring-security-adding-a-custom-role-prefix/" rel="nofollow noreferrer">http://bluefoot.info/howtos/spring-security-adding-a-custom-role-prefix/</a></p>