title: Spring Security java.lang.IllegalArgumentException: Failed to evaluate expression 'ROLE_ADMIN'
body: <p>I'm working with the book "<strong>Amuthan G - Spring MVC Beginner's Guide</strong>". Currently I'm trying to implement security using the next <code>security-context.xml</code>:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/mvc
  http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-4.1.xsd
  http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
  http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd"&gt;
      &lt;security:http auto-config="true"&gt;
          &lt;security:intercept-url pattern="/products/add" access="ROLE_ADMIN" /&gt;
          &lt;security:form-login login-page="/login"
                               default-target-url="/products/add"
                               authentication-failure-url="/loginfailed"/&gt;
          &lt;security:logout logout-success-url="/logout" /&gt;
      &lt;/security:http&gt;
  
      &lt;security:authentication-manager&gt;
          &lt;security:authentication-provider&gt;
              &lt;security:user-service&gt;
                  &lt;security:user name="Admin" password="Admin123" authorities="ROLE_ADMIN" /&gt;
              &lt;/security:user-service&gt;
          &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>Security related configuration in the <code>web.xml</code>:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/spring/webcontext/security-context.xml&lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>But this example end up with <code>IllegalArgumentException</code> while opening the secured path: </p>
  
  <pre><code>java.lang.IllegalArgumentException: Failed to evaluate expression 'ROLE_ADMIN'
      org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:30)
      org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:54)
      org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:35)
      org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:63)
      org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
      org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
      org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:112)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:206)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:106)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
      org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
      org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
      org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
  root cause
  
  org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Property or field 'ROLE_ADMIN' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot' - maybe not public?
      org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:224)
      org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:94)
      org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:81)
      org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:131)
      org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:299)
      org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:26)
      org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:54)
      org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:35)
      org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:63)
      org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
      org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
      org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:115)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:112)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:206)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:121)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:100)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
      org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:106)
      org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
      org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
      org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
      org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
  </code></pre>
  
  <p>It looks like this issue is related to obsolete security configuration but I failed to find something in migration guide from Spring 3 to Spring 4. Are there any soluions or I should just implement it another way?</p>