title: Spring Security+MVC annotations Illegal argument exception
body: <p>I'm using spring MVC and spring security. </p>
  
  <p>I have annotation-driven controller and trying to add security annotations to it.</p>
  
  <p>Controller code:</p>
  
  <pre><code>@Controller
  public class SomeController implements MessageSourceAware {
  
      @Secured("ROLE_ADMIN")
      @RequestMapping(value = "/somepage", method = RequestMethod.GET)
      public String getPage(HttpServletRequest request, ModelMap model) {
          // logic
          return ADMIN_VIEW_NAME;
      }</code></pre>
  
  <p>My <code>spring-security.xml</code>:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="
         http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
         http://www.springframework.org/schema/security
         http://www.springframework.org/schema/security/spring-security-3.1.xsd"&gt;
  
      &lt;security:global-method-security secured-annotations="enabled" /&gt;
  
      &lt;security:http auto-config="true" use-expressions="true" access-denied-page="/denied"&gt;
  
          &lt;security:intercept-url pattern="/login" access="permitAll"/&gt;
          &lt;!--&lt;security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/&gt;--&gt;
  
          &lt;security:form-login
                  login-page="/login"
                  authentication-failure-url="/login?error=true"
                  default-target-url="/index"/&gt;
  
          &lt;security:logout
                  invalidate-session="true"
                  logout-success-url="/login"
                  logout-url="/logout"/&gt;
  
      &lt;/security:http&gt;
  
      &lt;!-- Declare an authentication-manager to use a custom userDetailsService --&gt;
      &lt;security:authentication-manager&gt;
          &lt;security:authentication-provider user-service-ref="authManager"&gt;
              &lt;security:password-encoder ref="passwordEncoder"/&gt;
          &lt;/security:authentication-provider&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;!-- Use a SHA encoder since the user's passwords are stored as SHA in the database --&gt;
      &lt;bean class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" id="passwordEncoder"/&gt;
  
      &lt;!-- A custom service where Spring will retrieve users and their corresponding access levels  --&gt;
      &lt;bean id="authManager" class="some.package.AdminManager"/&gt;
  
  &lt;/beans&gt;</code></pre>
  
  <p>When I try open secured page I get following error:</p>
  
  <pre><code>org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.IllegalArgumentException: object is not an instance of declaring class
  HandlerMethod details: 
  Controller [$Proxy139]
  Method [public java.lang.String SomeController.getPage(javax.servlet.http.HttpServletRequest,org.springframework.ui.ModelMap)]
  Resolved arguments: 
  [0] [type=org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper] [value=SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.connector.RequestFacade@7a31c825]]]
  [1] [type=org.springframework.validation.support.BindingAwareModelMap] [value={}]</code></pre>
  
  <p>If I remove secured annotation and uncomment following line in <code>spring-security.xml</code>:</p>
  
  <pre><code>&lt;security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')"/&gt;</code></pre>
  
  <p>Everything works fine.</p>
  
  <p>Thank you for any help.</p>