title: Spring security 4 @PreAuthorize(hasAuthority()) access denied
body: <p>I am trying to convert a Spring Security 3 @Secured("admin") annotation into Spring Security 4 compatible fashion.</p>
  
  <p>This is my <code>usersService.java</code></p>
  
  <pre><code>@PreAuthorize("hasAuthority('admin')")
  public List&lt;User&gt; getAllUsers() {
      return usersDao.getAllUsers();
  }
  </code></pre>
  
  <p>Then in <code>security-context.xml</code> I have:</p>
  
  <pre><code>&lt;security:intercept-url pattern="/admin" access="permitAll" /&gt;
  ...
  &lt;security:global-method-security pre-post-annotations="enabled" /&gt;
  </code></pre>
  
  <p><code>getAllUsers()</code> is called by a <code>LoginController.java</code></p>
  
  <pre><code>@RequestMapping("/admin")
  public String showAdmin(Model model) {
      List&lt;User&gt; users = usersService.getAllUsers();
  
      model.addAttribute("users", users);
  
      return "admin";
  }
  </code></pre>
  
  <p>In mySql database, there are two tables, users and authorities. <code>authorities</code> has 2 columns, username and authority. <code>administrator</code> has authority <code>admin</code>.</p>
  
  <p>Now if I trie to access <code>/admin</code>, I will be redirected to <code>/login</code>, but after I log in with <code>administrator</code>, I still get "access denied".</p>
  
  <p>I think I must have missed something very basic but as I am new to Spring, I could not figure it out. Any help would be appreciated. Thanks.</p>
  
  <p>Update: I tried changing the annotation to @PreAuthorize("hasRole('ROLE_ADMIN')") and I also changed the "authority" column in mySql for admin from "admin" to "ROLE_ADMIN" but it still gives me 403. I did not have much faith on this because before this error, I had to change <code>hasRole('admin')</code> in <code>securityContext.xml</code> to <code>hasAuthority('admin')</code>.</p>