title: @Secured does not work in controller, but intercept-url seems to be working fine
body: <p>It doesn't look like @Secured on methods in my @Controller are being read. When security filtering based on sec:intercept-url is being used, this seems to be working just fine. The following code results in Spring Security giving me this log entry: </p>
  
  <blockquote>
    <p>DEBUG: org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Public object - authentication not attempted</p>
  </blockquote>
  
  <p><strong>web.xml</strong></p>
  
  <p>
      
          contextConfigLocation
          
              /WEB-INF/spring/root-context.xml
          
      </p>
  
  <pre><code>&lt;!-- Creates the Spring Container shared by all Servlets and Filters --&gt;
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;!-- Processes application requests --&gt;
  &lt;servlet&gt;
      &lt;servlet-name&gt;appServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/spring/appServlet/servlet-context.xml
          &lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;!-- Filter security --&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>servlet-context.xml holds the configuration of the viewResolvers and all the marshalling. This configuration is annotation-driven.</p>
  
  <p><strong>root-context.xml</strong></p>
  
  <pre><code>    &lt;sec:global-method-security secured-annotations="enabled" /&gt;
  
  &lt;sec:http auto-config="true"&gt;
      &lt;sec:http-basic/&gt;
  &lt;/sec:http&gt;
  
  &lt;!-- Declare an authentication-manager to use a custom userDetailsService --&gt;
  &lt;sec:authentication-manager&gt;
      &lt;sec:authentication-provider
          user-service-ref="userDetailsService"&gt;
          &lt;sec:password-encoder ref="passwordEncoder" /&gt;
      &lt;/sec:authentication-provider&gt;
  &lt;/sec:authentication-manager&gt;
  
  &lt;bean
      class="org.springframework.security.authentication.encoding.PlaintextPasswordEncoder"
      id="passwordEncoder" /&gt;
  &lt;sec:user-service id="userDetailsService"&gt;
      &lt;sec:user name="john" password="john" authorities="ROLE_USER, ROLE_ADMIN" /&gt;
      &lt;sec:user name="jane" password="jane" authorities="ROLE_USER" /&gt;
  &lt;/sec:user-service&gt;
  </code></pre>
  
  <p><strong>PingController.java</strong></p>
  
  <pre><code>@Controller
  public class PingController {
  
      @Secured("ROLE_ADMIN")
      @RequestMapping(value = "/ping", method = RequestMethod.GET)
      public void ping() {
      }
  
  }
  </code></pre>
  
  <p>This doesn't seem to have any relation to which authentication method I'm using, so the basic-http-tag can be overlooked.</p>
  
  <p>I have this idea that the @Secured doesn't work because of it being used in another context than the root-context.xml in which the security is being configured. I've tried to move this configuration to the servlet-context.xml, but it doesn't seem to reach the springSecurityFilterChain. Any thoughts on the problem and and my theory? </p>