title: Spring Security-acl. Users do not receive permission
body: <p>It seems to be all right. Authorization is working, and users get the roles. I protected the methods of using annotations (for example @PreAuthorize("hasPermission(#post, 'READ')") ), it works and I get access denied. I created a database in which he described the rights of users to objects. I created a database which contains the user's permission on objects.</p>
  
  <p>My problem is that after the user's authorization, it is not getting permissions, and even if the user has the authority to object, he gets access denied. Also, I noticed that after a user login in the log file of the server should get a string which will write what permission he got, but I have no such line.</p>
  
  <p>Pieces of my files:</p>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>...
  &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  
  &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;
          /WEB-INF/spring-security.xml
          /WEB-INF/acl-context.xml
          /WEB-INF/mvc-dispatcher-servlet.xml 
      &lt;/param-value&gt;
  &lt;/context-param&gt;...
  </code></pre>
  
  <p><strong>mvc-dispatcher-servlet.xml</strong></p>
  
  <pre><code>    ...
  &lt;security:global-method-security pre-post-annotations="enabled"&gt;
      &lt;security:expression-handler ref="expressionHandler" /&gt;
  &lt;/security:global-method-security&gt;
  
  &lt;context:annotation-config /&gt;
  
  &lt;tx:annotation-driven /&gt;
  &lt;tx:jta-transaction-manager /&gt;
  
  &lt;context:component-scan base-package="com.bla-bla.bla.controllers" /&gt;
  
  &lt;mvc:annotation-driven /&gt;
  ...
  </code></pre>
  
  <p><strong>spring-security.xml</strong></p>
  
  <pre><code>    ...
  &lt;security:http auto-config="true" use-expressions="true"
      access-denied-page="/auth/denied.html"&gt;
      &lt;security:intercept-url pattern="/auth/login.html" access="permitAll" /&gt;
      &lt;security:form-login login-page="/auth/login.html"
          authentication-failure-url="/auth/login.html?error=true"
          default-target-url="/index.html" /&gt;
      &lt;security:logout invalidate-session="true"
          logout-success-url="/auth/login.html" logout-url="/auth/logout.html" /&gt;
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager&gt;
      &lt;security:authentication-provider
          user-service-ref="userService"&gt;
          &lt;security:password-encoder ref="pswEncoder" /&gt;
      &lt;/security:authentication-provider&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="userService"
      class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl"&gt;
      &lt;property name="dataSource" ref="jndiJboss" /&gt;
      &lt;property name="usersByUsernameQuery"
          value="SELECT login, pass, enabled FROM accounts WHERE login=?" /&gt;
      &lt;property name="authoritiesByUsernameQuery"
          value="SELECT login, authority FROM accounts WHERE login=?" /&gt;
  &lt;/bean&gt;
  
  &lt;bean
      class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"
      id="pswEncoder" /&gt;
  ...
  </code></pre>
  
  <p><strong>acl-context.xml</strong></p>
  
  <pre><code>    ...
  &lt;bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"
      p:permissionEvaluator-ref="permissionEvaluator"
      p:roleHierarchy-ref="roleHierarchy" /&gt;
  
  &lt;bean class="org.springframework.security.acls.AclPermissionEvaluator" id="permissionEvaluator"&gt;
      &lt;constructor-arg ref="aclService"/&gt;
  &lt;/bean&gt;
  
  &lt;bean class="org.springframework.security.acls.jdbc.JdbcMutableAclService" id="aclService"&gt;
      &lt;constructor-arg ref="jndiJboss"/&gt;
      &lt;constructor-arg ref="lookupStrategy"/&gt;
      &lt;constructor-arg ref="aclCache"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy"&gt;
      &lt;constructor-arg ref="jndiJboss"/&gt;
      &lt;constructor-arg ref="aclCache"/&gt;
      &lt;constructor-arg ref="aclAuthorizationStrategy"/&gt;
      &lt;constructor-arg ref="auditLogger"/&gt;
  &lt;/bean&gt;
  
   &lt;bean id="jndiJboss" class="org.springframework.jndi.JndiObjectFactoryBean"&gt;
      &lt;property name="jndiName" value="java:/JBossDB"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache"&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.cache.ehcache.EhCacheFactoryBean"&gt;
              &lt;property name="cacheManager"&gt;
                  &lt;bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/&gt;
              &lt;/property&gt;
              &lt;property name="cacheName" value="aclCache"/&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;bean class="org.springframework.security.core.authority.GrantedAuthorityImpl"&gt;
                  &lt;constructor-arg value="ROLE_ADMIN"/&gt;
              &lt;/bean&gt;
              &lt;bean class="org.springframework.security.core.authority.GrantedAuthorityImpl"&gt;
                  &lt;constructor-arg value="ROLE_ADMIN"/&gt;
              &lt;/bean&gt;
              &lt;bean class="org.springframework.security.core.authority.GrantedAuthorityImpl"&gt;
                  &lt;constructor-arg value="ROLE_ADMIN"/&gt;
              &lt;/bean&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="auditLogger" class="org.springframework.security.acls.domain.ConsoleAuditLogger"/&gt;
  
  
  &lt;bean id="roleHierarchy"  class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"&gt;
      &lt;property name="hierarchy"&gt;
          &lt;value&gt;
              ROLE_ADMIN &gt; ROLE_USER
          &lt;/value&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  ...
  </code></pre>
  
  <p><strong>An example of a protected method of the controller</strong></p>
  
  <pre><code>@Override
  @RequestMapping(value = "/post/delete.html", method = RequestMethod.GET)
  @Transactional
  @PreAuthorize("hasPermission(#post, 'READ')")
  public String delete(final Post post) {
      //some actions
      return "post/view";
  }
  </code></pre>
  
  <p>In what could be the problem?</p>
  
  <p><strong>UPD</strong>. My problem was in the wrong filling acl_object_identity</p>