title: spring boot security with mongodb PostAuthorize and PreAuthorize not working
body: <p>Authentication is working but not the authorization.  Please help I'm unable to find what's going wrong.</p>
  
  <p><strong>Controller</strong></p>
  
  <pre><code>@RestController
  @RequestMapping("/v1/user")
  public class UserController {
  
      @PostAuthorize("hasRole('ROLE_ADMIN')") //@PreAuthorize("hasRole('ROLE_ADMIN')"), both are not working
      @RequestMapping(method = RequestMethod.DELETE)
      @ResponseStatus(HttpStatus.NO_CONTENT)
      public void deleteUser() {
          log.debug("Only Admin can access this");
  
          Authentication auth = SecurityContextHolder.getContext().getAuthentication();
          System.out.println("User name "+auth.getName()); //prints - User name pratap
          System.out.println("User Authorities "+auth.getAuthorities()); // prints - User Authorities [ADMIN]
      }
  }
  </code></pre>
  
  <p><strong>SecurityConfiguration.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private CustomUserDetailsService customUserDetailsService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests().anyRequest().fullyAuthenticated().and().
                  httpBasic().and().
                  csrf().disable();
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(customUserDetailsService);
      }
  }
  </code></pre>
  
  <p><strong>CustomUserDetailsService.java</strong></p>
  
  <pre><code>@Service
  public class CustomUserDetailsService implements UserDetailsService {
  
      @Autowired
      private UserRepository userRepository;
  
      @Override
      public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
          User user = userRepository.findByUsername(username);
          System.out.println("username "+user.getUsername());
          if(user != null) {
              return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), true, true, true, true,
                      AuthorityUtils.createAuthorityList("ADMIN"));
          } else {
              throw new UsernameNotFoundException("could not find the user '"
                      + username + "'");
          }
      }
  }
  </code></pre>
  
  <p><strong>Error:</strong></p>
  
  <pre><code>{
    "timestamp": 1472789456591,
    "status": 403,
    "error": "Forbidden",
    "message": "Access is denied",
    "path": "/v1/user/pratap"
  }
  </code></pre>