title: spring security Annotation @Preauthoritze does not working
body: <p>i tried to use Spring security 3.1</p>
  
  <p>but When i ROLE_USER authority</p>
  
  <p>it doesn't do anything ( annotation @PreAuthorize("hasRole('ROLE_ADMIN')") )</p>
  
  <p>I'm useing spring 3.1M and springsecurity 3.1</p>
  
  <p>Do I need to do anything else ?</p>
  
  <p>the following is my springsecurity configulation code </p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="UTF-8"?&gt;
      &lt;beans xmlns="http://www.springframework.org/schema/beans"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
          xmlns:s="http://www.springframework.org/schema/security"
          xsi:schemaLocation="http://www.springframework.org/schema/beans
                              http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                              http://www.springframework.org/schema/security
                              http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
        &lt;s:global-method-security pre-post-annotations="enabled"&gt;
          &lt;!-- &lt;s:expression-handler ref="expressionHandler"/&gt; --&gt;
        &lt;/s:global-method-security&gt;
  
  
          &lt;s:http pattern="/css/**" security="none" /&gt;
          &lt;s:http pattern="/js/**" security="none" /&gt;
          &lt;s:http pattern="/favicon.ico" security="none" /&gt;
          &lt;s:http pattern="/index.jsp" security="none" /&gt;
  
          &lt;s:http auto-config="true" use-expressions="true" access-denied-page="/denied.jsp"&gt;
  
              &lt;s:intercept-url pattern="/web/index" access="permitAll" /&gt;
              &lt;s:intercept-url pattern="/web/**" access="isAuthenticated()"/&gt;
              &lt;s:intercept-url pattern="/web/study/*" access="hasRole('ROLE_USER')"/&gt;
  
              &lt;s:form-login /&gt;
              &lt;s:logout /&gt;
  
              &lt;s:session-management&gt;
                  &lt;s:concurrency-control
                      error-if-maximum-exceeded="true" max-sessions="1" expired-url="/expired.jsp" /&gt;
              &lt;/s:session-management&gt;
          &lt;/s:http&gt;
  
          &lt;!-- Declare an authentication-manager to use a custom userDetailsService --&gt;
          &lt;s:authentication-manager&gt;
              &lt;s:authentication-provider user-service-ref="userDetailsService"&gt;
                  &lt;s:password-encoder ref="passwordEncoder" /&gt;
              &lt;/s:authentication-provider&gt;
          &lt;/s:authentication-manager&gt;
  
          &lt;!-- Use a Md5 encoder since the user's passwords are stored as Md5 in the 
              database --&gt;
          &lt;bean
              class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"
              id="passwordEncoder" /&gt;
  
          &lt;s:authentication-manager alias="authenticationManager"&gt;
              &lt;!-- If you want to use a database, then you can use --&gt;
              &lt;s:authentication-provider user-service-ref="userDetailsService"&gt;
  
                  &lt;s:password-encoder ref="passwordEncoder" /&gt;
              &lt;/s:authentication-provider&gt;
          &lt;/s:authentication-manager&gt;
  
      &lt;/beans&gt;
  </code></pre>
  
  <p>and contoroller code</p>
  
  <pre><code>    package com.app.web.study.language.action;
  
      import java.util.*;
  
      import javax.annotation.Resource;
      import javax.servlet.http.HttpServletRequest;
      import org.slf4j.Logger;
      import org.slf4j.LoggerFactory;
      import org.springframework.security.access.annotation.Secured;
      import org.springframework.security.access.prepost.PreAuthorize;
      import org.springframework.stereotype.Controller;
      import org.springframework.transaction.annotation.Transactional;
      import org.springframework.ui.Model;
      import org.springframework.web.bind.annotation.RequestMapping;
      import org.springframework.web.bind.annotation.RequestMethod;
      import org.springframework.web.bind.annotation.RequestParam;
      import com.app.web.common.BaseController;
      import com.app.web.study.language.service.impl.StudyServiceImpl;
  
      @Controller
      public class StudyController extends BaseController {
  
          protected static Logger logger = LoggerFactory.getLogger("StudyController");
  
          @Resource(name="studyServiceImpl")
          private StudyServiceImpl studyServiceImpl;
  
          @PreAuthorize("hasRole('ROLE_ADMIN')") 
          @RequestMapping(value = "/study/list", method = RequestMethod.GET)
          public String study( Locale locale
                             , Model model 
                             , HttpServletRequest  req) {
              logger.info("study", locale);
  
              HashMap&lt;String, Object&gt; parameters = new HashMap&lt;String, Object&gt;(); 
              List list = studyServiceImpl.getList(parameters);  
  
              model.addAttribute("ctx", getCrreuntUrl() );
              model.addAttribute("list", list );
  
              //model.addAttribute("activeUsers", getlistActiveUsers());
  
              return "base.study";
          }
  
      }
  </code></pre>