title: Spring Security hasAnyRole not working
body: <p>I´m developing an application with spring security authentication and MongoDB. The authentication method is working fine but only with <code>ROLE_ADMIN</code>. All methods that I need authentication for are annotated with: </p>
  
  <p><code>@PreAuthorize("hasAnyRole('ROLE_ADMIN', 'ROLE_USER')")</code></p>
  
  <p>When I try to authenticate with a user that has <code>ROLE_USER</code> I always get access declined error.</p>
  
  <p>My spring security config is:</p>
  
  <pre><code>&lt;security:global-method-security pre-post-annotations="enabled" /&gt;  
  &lt;security:http auto-config="true" use-expressions="true"&gt;
  &lt;intercept-url pattern="/login" access="permitAll" /&gt;
  &lt;intercept-url pattern="/logout" access="permitAll" /&gt;
  &lt;intercept-url pattern="/admin/**" 
    access="hasRole('ROLE_ADMIN') and hasRole('ROLE_USER')" /&gt;
  &lt;security:form-login login-page="/login" default-target-url="/admin/main" 
     authentication-failure-url="/accessdenied" /&gt;
          &lt;security:logout logout-success-url="/logout" /&gt;
  
          &lt;security:session-management&gt;
              &lt;security:concurrency-control error-if-maximum-exceeded="true" 
                 max-sessions="1"/&gt;
          &lt;/security:session-management&gt;
      &lt;/security:http&gt;
  </code></pre>
  
  <p>If I use:</p>
  
  <pre><code>&lt;intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN') and hasRole('ROLE_USER')" /&gt;
  </code></pre>
  
  <p>I get access denied for both <code>ROLE_ADMIN</code> and <code>ROLE_USER</code>.</p>
  
  <p>If I use:</p>
  
  <pre><code>&lt;intercept-url pattern="/admin/**" access="hasAnyRole('ROLE_ADMIN', 'ROLE_USER')" /&gt;
  </code></pre>
  
  <p>I can log in with a <code>ROLE_ADMIN</code> user but I can´t with <code>ROLE_USER</code>.</p>
  
  <p>and in my <code>LoginService</code> I have:</p>
  
  <pre><code>public UserDetails loadUserByUsername(String email)
              throws UsernameNotFoundException {
          boolean enabled = true;
          boolean accountNonExpired = true;
          boolean credentialsNonExpired = true;
          boolean accountNonLocked = true;
  
          User user = getUserDetail(email);
  
          userdetails = new org.springframework.security.core.userdetails.User(
                  user.getEmail(), user.getPwd(), enabled,
                  accountNonExpired, credentialsNonExpired, accountNonLocked,
                  getAuthorities(user.getIsAdmin()));
  
          return userdetails;
      }
  
      public List&lt;GrantedAuthority&gt; getAuthorities(Integer role) {
          List&lt;GrantedAuthority&gt; authList = new ArrayList&lt;GrantedAuthority&gt;();
          if (role.intValue() == 0) {
              authList.add(new SimpleGrantedAuthority("ROLE_USER"));
          } else if (role.intValue() == 1) {
              authList.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
          }
          System.out.println(authList);
          return authList;
      }
  </code></pre>
  
  <p>What am I missing?</p>