title: Spring Boot Role Based Authentication
body: <p>I have a problem concerning Spring Boot role based authentication. Basically, I would like to have users and admins and I want to prevent users from accessing admin resources. So I created a SecurityConfig class:</p>
  
  <pre><code>package test;
  
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
  
  @Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
     @Override
     protected void configure(AuthenticationManagerBuilder auth) throws Exception {
         auth.inMemoryAuthentication()
             .withUser("user1").password("password1").roles("USER, ADMIN")
             .and()
             .withUser("user2").password("password2").roles("USER");
     }
  
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http.authorizeRequests()
             .antMatchers("/service/test").access("hasRole('USER') or hasRole('ADMIN')")
             .antMatchers("/service/admin").access("hasRole('ADMIN')");
     }
  }
  </code></pre>
  
  <p>This is my little REST service:</p>
  
  <pre><code>package test;
  
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  import org.springframework.web.bind.annotation.RestController;
  
  @RestController
  @RequestMapping("/service")
  public class RestService {
  
      @RequestMapping(value = "/test", method = RequestMethod.GET)
      public String echo() {
          return "This is a test";
      }
  
      @RequestMapping(value = "/admin", method = RequestMethod.GET)
      public String admin() {
          return "admin page";
      }
  }
  </code></pre>
  
  <p>And my Application class:</p>
  
  <pre><code>package test;
  
  import org.springframework.boot.SpringApplication;
  import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
  import org.springframework.boot.autoconfigure.SpringBootApplication;
  
  @SpringBootApplication
  @EnableAutoConfiguration 
  public class Application {
  
      public static void main(String[] args) {
          SpringApplication.run(Application.class, args);
      }
  }
  </code></pre>
  
  <p>Unfortunately, I always get a 403 "forbidden/access denied" error message when executing "curl user1:password1@localhost:8080/service/admin"... Did I miss anything in the configure method?</p>
  
  <p>Thank you very much in advance!</p>