title: Spring Security Admin unable to access Admin pages (type=Forbidden, status=403)
body: <p>I am currently working on a simple Spring application and trying to create the admin-only side of things.</p>
  <p>I used .antMatchers in my Security Config Class to set &quot;/admin&quot; to only be accessible to users with the ADMIN role, however when logging in as a user with the ADMIN role I am unable to access the page at &quot;/admin&quot;.</p>
  <p>(type=Forbidden, status=403)</p>
  <p>I should also mention that
  I'm using Postman with json requests to register the user. However, anytime I try register a User the role is automatically set as 'USER' even though I've tried to set it as 'ADMIN' within the Postman request i.e.
  {
  &quot;restaurantName&quot;: &quot;Thai Palace&quot;,
  &quot;email&quot;: &quot;Tai@gmail.com&quot;,
  &quot;password&quot;: &quot;123&quot;,
  &quot;appUserRole&quot;: &quot;ADMIN&quot;
  }</p>
  <p>I ended up setting the appUserRole to &quot;ADMIN&quot; using an SQL query.</p>
  <pre><code>UPDATE rest_info set app_user_role= &quot;ADMIN&quot; WHERE rest_id=3;
  </code></pre>
  <p>Maybe it's not setting the role properly and this is the issue? I'm new to Spring so it's probably something relatively easy that I'm not seeing.</p>
  <p>Any insights would be greatly appreciated!</p>
  <p>Please see my Web Security Config class below:</p>
  <pre><code>package com.bron.demoJPA.secure.config;
  
  @Configuration
  @AllArgsConstructor
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  //-------------
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          // TODO Auto-generated method stub
  
          http.authorizeRequests().antMatchers(&quot;/admin&quot;).hasRole(&quot;ADMIN&quot;).antMatchers(&quot;/user&quot;).hasRole(&quot;USER&quot;).and()
                  .formLogin();
  
          http.csrf().disable().authorizeRequests().antMatchers(&quot;/api/v*/registration/**&quot;).permitAll().anyRequest()
                  .authenticated().and().logout().logoutRequestMatcher(new AntPathRequestMatcher(&quot;/logout&quot;))
                  .logoutSuccessUrl(&quot;/login&quot;);
  
      }
  
      private final AppUserService appUserService;
      private final BCryptPasswordEncoder bCryptPasswordEncoder;
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(daoAuthenticationProvider());
      }
  
      @Bean
      public DaoAuthenticationProvider daoAuthenticationProvider() {
  
          DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
          provider.setPasswordEncoder(bCryptPasswordEncoder);
          provider.setUserDetailsService(appUserService);
          return provider;
  
      }
  
  }
  </code></pre>
  <p>Please see my AppUser class below:</p>
  <pre><code>package com.bron.demoJPA.appuser;
  
  @Getter
  @Setter
  @NoArgsConstructor
  @EqualsAndHashCode
  @Entity
  @ToString(exclude = &quot;opening&quot;)
  @Table(name = &quot;Rest_info&quot;)
  
  public class AppUser implements UserDetails {
      @Id
      // Auto generate primary key
      @SequenceGenerator(name = &quot;user_sequence&quot;, sequenceName = &quot;user_sequence&quot;, allocationSize = 1)
      @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = &quot;user_sequence&quot;)
      @Column(name = &quot;Rest_ID&quot;)
      private long id;
  
      @Column(name = &quot;Rest_Name&quot;)
      private String restaurantName;
  
      @Embedded
      private Address address;
  
      @Column(name = &quot;Rest_Phone_Number&quot;)
      private String phoneNumber;
  
      @Column(name = &quot;Rest_Password&quot;)
      private String password;
  
      @Column(name = &quot;Rest_Email_Address&quot;)
      private String email;
  
      @Enumerated(EnumType.STRING)
      private AppUserRole appUserRole;
      private Boolean locked = false;
      // don't enable user until email verification
      private Boolean enabled = false;
  
      public AppUser(String restname, String email, String pass, AppUserRole app) {
          this.restaurantName = restname;
          this.email = email;
          this.password = pass;
          this.appUserRole = app;
      }
  
      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
          SimpleGrantedAuthority authority = new SimpleGrantedAuthority(appUserRole.name());
          return Collections.singletonList(authority);
      }
  
      @Override
      public String getUsername() {
          return email;
      }
  
      @Override
      public String getPassword() {
          return password;
      }
  
      @Override
      public boolean isAccountNonExpired() {
          return true;
      }
  
      @Override
      public boolean isAccountNonLocked() {
          return !locked;
      }
  
      @Override
      public boolean isCredentialsNonExpired() {
          return true;
      }
  
      @Override
      public boolean isEnabled() {
          return enabled;
      }
      
      //need reference to restaurant info but one to one relationship 
      //already defined by openingHour object in opening hour table
      
      @OneToOne(
              mappedBy = &quot;appUser&quot;
              )
      private OpeningHour opening;
  }
  </code></pre>
  <p>Please see my AppUserRole enum below:</p>
  <pre><code>package com.bron.demoJPA.appuser;
  public enum AppUserRole {
      USER,
      ADMIN
  }
  </code></pre>
  <p>Please see my Registration Request class below:</p>
  <pre><code>package com.bron.demoJPA.registration;
  
  @EqualsAndHashCode
  @ToString
  @Getter
  @NoArgsConstructor
  
  
  public class RegistrationRequest {
      private  String restaurantName;
      private  String email;
      private  String password;
      private  AppUserRole role;
  
      public RegistrationRequest(String restaurantName, String email, String password, AppUserRole role) {
          super();
          this.restaurantName = restaurantName;
          this.email = email;
          this.password = password;
          this.role = role;
      }
      
      
  }
  </code></pre>