title: Spring Security role hierarchy @Secured JavaConfig
body: <p>I've run into some problems trying to implemented a role hierarchy in Spring Security with JavaConfig rather than XML. Is there any way to implement a role hierarchy with the @Secured annotation rather than HttpSecurity antMatchers? I cannot seem to add the role hierarchy to HttpSecurity without providing the proper String patterns, though I'd like to be able to make access decisions exclusively using @Secured.</p>
  
  <pre><code>java.lang.IllegalStateException: At least one mapping is required (i.e. authorizeRequests().anyRequest.authenticated())
  
  @Bean
  public RoleHierarchyImpl roleHierarchy() {
      RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
      roleHierarchy.setHierarchy("ROLE_ADMIN &gt; ROLE_USER");
      return roleHierarchy;
  }
  
  private SecurityExpressionHandler&lt;FilterInvocation&gt; webExpressionHandler() {
      DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
      defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy());
      return defaultWebSecurityExpressionHandler;
  }
  
  public void configure(HttpSecurity http){
  http.authorizeRequests().expressionHandler(webExpressionHandler()).and().//other stuff
  }
  </code></pre>
  
  <p>Any help on this is greatly appreciated.</p>