title: How to integrate Spring Security for Role based url/method access
body: <p>I need to provide role based access for my REST APIs and I have seen that we could use <code>@PreAuthorize, @Secured</code> for this. However I am not sure as to what changes should I make and get this in place as currently I use a <code>custom token based authentication mechanism</code> generate a token for a session and handle it myself.</p>
  
  <pre><code>  @RequestMapping(value = "login", method = RequestMethod.POST)
          public @ResponseBody Result login(@RequestBody Credentials credentials) {
          return loginService.login(credentials.getUsername(), credentials.getPassword());
          }
  </code></pre>
  
  <p>The Result class just contains a generated token for the user which he will be passing on each request.</p>
  
  <p>Now any idea what changes should I make to restrict the access of an API if the user is in particular role</p>
  
  <p>For example if I want to restrict the API <code>findById</code> to be accessed by user only if he is part of <code>ADMIN_ROLE</code> then I will have to add the <code>PreAuthorize</code> annotation but am not sure how will this determine the user role and block the user automatically.</p>
  
  <pre><code>@PreAuthorize("ADMIN_ROLE")
  @RequestMapping(value = "{id}", method = RequestMethod.GET)
  public @ResponseBody Group findById(@PathVariable int id) {
      return groupParser.getGroupById(id, groupService.getGroupTree());
  }
  </code></pre>