title: Can't get @Secured working in Spring MVC
body: <p>I'm using Spring MVC to expose RESTful services. I already enabled authentication via HTTPBasicAuthentication, and using <code>&lt;security:http&gt;</code> i can control which roles can access urls.</p>
  
  <p>Now I want to use <code>@Secured</code> annotation. I tried to add it to Controller methods but it doesn't work. It simply does nothing.</p>
  
  <p>Here is my <code>Controller</code> class:</p>
  
  <pre><code>@Controller
  @RequestMapping("/*")
  public class HomeController {
  private static final Logger logger = LoggerFactory.getLogger(HomeController.class);
  
  private static final String USERS = "/users";
  private static final String USER = USERS+"/{userId:.*}";
  
      @RequestMapping(value=USER, method=RequestMethod.GET)
      @Secured(value = {"ROLE_ADMIN"})
      public @ResponseBody User signin(@PathVariable String userId) {
          logger.info("GET users/"+userId+" received");
          User user= service.getUser(userId);
          if(user==null)
                  throw new ResourceNotFoundException();
          return user;
      }
  }
  </code></pre>
  
  <p>This is my <code>security-context.xml</code>:</p>
  
  <pre><code>&lt;http auto-config='true'&gt;
      &lt;intercept-url pattern="/**" access="ROLE_USER"/&gt;
  &lt;/http&gt;
  
  &lt;global-method-security secured-annotations="enabled" /&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider&gt;
          &lt;user-service&gt;
              &lt;user name="admin@somedomain.com" password="admin"
                  authorities="ROLE_USER, ROLE_ADMIN" /&gt;
              &lt;user name="user@somedomain.com" password="pswd"
                  authorities="ROLE_USER" /&gt;
          &lt;/user-service&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  </code></pre>
  
  <p>And my <code>root-context.xml</code>:</p>
  
  <pre><code>&lt;context:component-scan base-package="org.mypackage" /&gt;
  
  &lt;import resource="database/DataSource.xml"/&gt; 
  
  &lt;import resource="database/Hibernate.xml"/&gt;
  
  &lt;import resource="beans-context.xml"/&gt; 
  
  &lt;import resource="security-context.xml"/&gt; 
  </code></pre>
  
  <p>All works fine, but If I add <code>@Secured</code>, it simply does nothing: I can access secured method with user@somedomain.com also, which hasn't ROLE_ADMIN privileges. 
  I already tried to move <code>&lt;security:global-method-security&gt;</code> to <code>root-context.xml</code>, it doesn't work. I also tried to secure the same method via <code>&lt;security:http&gt;</code> tag, it works fine, but I want to use <code>@Secured</code> annotation.</p>
  
  <p>Thank you.</p>
  
  <p>EDIT:
  I've also a <code>servlet-context.xml</code> and a <code>controllers.xml</code> config file in the appServlet subdirectory.</p>
  
  <p>Here is <code>servlet-context.xml</code>:
      </p>
  
  <pre><code>&lt;mvc:resources mapping="/resources/**" location="/resources/" /&gt;
  
  &lt;beans:bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
      &lt;beans:property name="prefix" value="/WEB-INF/views/" /&gt;
      &lt;beans:property name="suffix" value=".jsp" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:import resource="controllers.xml" /&gt;
  </code></pre>
  
  <p>And <code>controllers.xml</code>:</p>
  
  <pre><code>&lt;context:component-scan base-package="org.mose.emergencyalert.controllers" /&gt;
  
  &lt;beans:bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver" /&gt;     
  
  &lt;beans:bean id="homeController" class="org.mose.emergencyalert.controllers.HomeController"/&gt; 
  </code></pre>