title: How to apply roles using HttpSecurity (Spring Security)?
body: <p>I am using Spring Security 3.2.3.RELEASE</p>
  
  <p>And here is code of my WebSecurityConfigurerAdapter</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityContext extends WebSecurityConfigurerAdapter {
  
  private static final Logger log = LogManager.getLogger(WebSecurityContext.class);
  
  @Autowired
  private AuthenticationProvider authenticationProvider;
  
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      log.info("Setting AuthenticationManagerBuilder");
      auth.authenticationProvider(authenticationProvider);
  }
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      log.info("Configuring HttpSecurity");
      http
              .authorizeRequests()
                  .antMatchers("/admin/**").hasRole("ADMIN")
                  .antMatchers("/**").hasRole("USER")
                  .anyRequest().authenticated()
                  .and()
                  .httpBasic();
  
  }
  }
  </code></pre>
  
  <p>And result is: HTTP Status 403 - Access is denied</p>
  
  <p>But if I comment this line:</p>
  
  <pre><code>//.antMatchers("/**").hasRole("USER")
  </code></pre>
  
  <p>Everything works fine. Which means (I guess) something wrong with my roles or HttpSecurity.</p>
  
  <p>So I started debugging. I double check that my UserDetails have two GrantedAuthorities with names: ADMIN, USER.</p>
  
  <p>So any ideas what could cause the problem? </p>