title: Spring Security 3.1.4 taglib authorize/authentication are not working with role hierarchy in JSF 2.2 on Tomcat 7
body: <p>The roleHeirarchies are taken into account for Web Security Expressions defined as intercept URLs via the http namespace but not in expressions using the JSP Authorize taglib.</p>
  
  <p>I read a lot of stuffs already... <a href="https://stackoverflow.com/questions/13132922/spring-security-taglib-secauthorize-with-role-hierarchy-not-working?rq=1">ref1</a> <a href="https://stackoverflow.com/questions/13860705/spring-security-role-hierarchy-issues?rq=1">ref2</a> <a href="https://stackoverflow.com/questions/13860705/spring-security-role-hierarchy-issues">ref3</a> <a href="https://stackoverflow.com/questions/11431469/how-to-get-spring-security-role-hierarchy-in-jsp-to-work?rq=1">ref4</a> <a href="https://stackoverflow.com/questions/11431469/how-to-get-spring-security-role-hierarchy-in-jsp-to-work?rq=1">ref5</a> <a href="https://stackoverflow.com/questions/1572232/spring-security-securitycontext-authentication-null-in-taglib-and-jsp-but-ok-i">ref6</a></p>
  
  <p>****EDIT:**** <em>Ref1 and Ref6 mention stuffs about a problem with filters order and security context not available in jsp...(by the way,i'm using jsf2) maybe there is something to dig ...</em></p>
  
  <p><strong><em>EDIT 2:</em></strong> Is JSF handling security tag lib ? I read <a href="http://docs.spring.io/spring-webflow/docs/2.2.x/reference/html/ch13s09.html" rel="nofollow noreferrer">this</a> and try <a href="http://doanduyhai.wordpress.com/2012/02/26/spring-security-part-v-security-tags/" rel="nofollow noreferrer">that</a> with no sucess</p>
  
  <p><strong><em>EDIT 3 :</em></strong> : I tried to install via Maven spring-faces 2.3.2 and spring-security-taglibs...nothing happens...Some tuto said to create a custom taglib.xml but it didn't work too , i think it was for older version...</p>
  
  <p>I tested this  facesContext.externalContext.isUserInRole('ROLE') and sec:authorize access="hasRole('Role')... The first works only if it's the same ROLE but it's no taking account the hierarchy stuff... And sec: autorize simply do nothing, all the roles are printed.</p>
  
  <p><strong>See the example above whith a user with ROLE ROLE_ADMIN_PROFILER_NGS :</strong></p>
  
  <pre><code>    &lt;h:outputText rendered="#{facesContext.externalContext.isUserInRole('ROLE_ADMIN_PROFILER_NGS')}"  value ="ROLE_ADMIN_PROFILER_NGS"&gt;&lt;/h:outputText&gt; // WORKS &lt;br&gt;&lt;/br&gt;
  &lt;h:outputText rendered="#{facesContext.externalContext.isUserInRole('ROLE_GUEST')}"  value ="ROLE_GUEST"&gt;&lt;/h:outputText&gt; // SHOULD APPEAR BUT NOTHING HAPPENS&lt;br&gt;&lt;/br&gt;
  &lt;h:outputText rendered="#{facesContext.externalContext.isUserInRole('ROLE_ADMIN')}"  value ="ROLE_ADMIN"&gt; // SHOULD NOT APPEAR AND THAT'S THE CASE&lt;/h:outputText&gt;&lt;br&gt;&lt;/br&gt;
  
  /* ALL THE THREE NEXT ARE DISPLAYED WHITHOUT CONTROL AUTORIZATION.*/
  
  &lt;sec:authorize access="hasRole('ROLE_ADMIN_PROFILER_NGS')"&gt;ROLE_ADMIN_PROFILER_NGS&lt;br&gt;&lt;/br&gt;&lt;/sec:authorize&gt;
  &lt;sec:authorize access="hasRole('ROLE_GUEST')"&gt;ROLE_GUEST &lt;br&gt;&lt;/br&gt;&lt;/sec:authorize&gt;
  &lt;sec:authorize access="hasRole('ROLE_ADMIN')"&gt;ROLE_ADMIN  &lt;br&gt;&lt;/br&gt;&lt;/sec:authorize&gt;
  </code></pre>
  
  <p><strong>This is what I tried to access for testing with the role hierachies stuff :</strong></p>
  
  <p>When a User comes only with a Role GUEST...All the tag are showed...they souldn't appear, only GUEST (cf definition at bottom )should appear : </p>
  
  <pre><code>    &lt;sec:authentication property="username" /&gt;
      &lt;sec:authorize access="hasRole('ROLE_BABAB')"&gt;BABA&lt;/sec:authorize&gt;
      &lt;sec:authorize access="hasRole('ROLE_GUEST')"&gt;GUEST&lt;/sec:authorize&gt;
      &lt;sec:authorize access="hasRole('ROLE_ADMIN')"&gt;ADMIN&lt;/sec:authorize&gt;
  </code></pre>
  
  <p><strong>This is my security configuration :</strong> </p>
  
  <pre><code>   &lt;security:http auto-config="true" access-decision-manager-ref="accessDecisionManager" use-expressions="true" disable-url-rewriting="true"&gt;
      &lt;security:intercept-url pattern="/Participant/New/*" access="hasRole('ROLE_ADMIN')" /&gt;  
      &lt;security:intercept-url pattern="/Home" access="hasRole('ROLE_GUEST')" /&gt;  
      &lt;security:intercept-url pattern="/Login" access="hasRole('ROLE_ANONYMOUS')" /&gt;   
       &lt;security:intercept-url pattern="/Login/Error" access="hasRole('ROLE_ANONYMOUS')" /&gt;    
      &lt;security:form-login  login-page="/Login"  login-processing-url="/j_spring_security_check"  authentication-failure-url="/Login/Error" default-target-url="/Home" /&gt;
      &lt;security:logout logout-url="/j_spring_security_logout" logout-success-url="/Home" delete-cookies="JSESSIONID"  invalidate-session="true"/&gt;
      &lt;security:anonymous/&gt;
       &lt;security:expression-handler ref="defaultWebSecurityExpressionHandler" /&gt;
      &lt;security:session-management invalid-session-url="/Login" &gt;
          &lt;security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true"  /&gt;
      &lt;/security:session-management&gt;
     &lt;security:port-mappings&gt;
       &lt;security:port-mapping http="8086" https="8443"/&gt;
      &lt;/security:port-mappings&gt;
    &lt;/security:http&gt;
  
  &lt;beans:bean id="defaultWebSecurityExpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"&gt;
        &lt;beans:property name="roleHierarchy" ref="roleHierarchy"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"&gt;
    &lt;beans:property name="decisionVoters"&gt;
      &lt;beans:list&gt;
         &lt;beans:ref bean="roleVoter" /&gt;
          &lt;beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"&gt;
              &lt;beans:property name="expressionHandler" ref="defaultWebSecurityExpressionHandler"/&gt;
          &lt;/beans:bean&gt;
         &lt;beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/&gt;
  
      &lt;/beans:list&gt;
    &lt;/beans:property&gt;
  &lt;/beans:bean&gt;
  
  
  &lt;beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter"&gt;
      &lt;beans:constructor-arg ref="roleHierarchy" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"&gt;
      &lt;beans:property name="hierarchy"&gt;
          &lt;beans:value&gt;
              ROLE_ADMIN &gt; ROLE_ADMIN_PROFILER_NGS
              ROLE_ADMIN_PROFILER_NGS &gt; ROLE_GUEST
              ROLE_GUEST &gt; ROLE_GUEST_PROFILER_NGS  
              ROLE_ADMIN &gt; ROLE_ADMIN_PROFILER_CGH
              ROLE_ADMIN_PROFILER_CGH &gt; ROLE_GUEST
              ROLE_GUEST &gt; ROLE_GUEST_PROFILER_CGH
          &lt;/beans:value&gt;
      &lt;/beans:property&gt;
   &lt;/beans:bean&gt;
  </code></pre>
  
  <p>Thanks a lot , you are welcome if you have an other idea to test...</p>
  
  <p><strong><em>EDIT 3:</em></strong></p>
  
  <p>Why does it return 0 for RoleHierarchyVoter and 1 for WebExpressionVoter...is it normal ?</p>
  
  <blockquote>
    <p>14:48:32,861 DEBUG FilterSecurityInterceptor:194 - Secure object: FilterInvocation: URL: /Home; Attributes: [hasRole('ROLE_GUEST')]
    14:48:32,861 DEBUG FilterSecurityInterceptor:310 - Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@43a64f5f: Principal: com.clb.genomic.lyon.model.User@d46: Username: jp; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN_PROFILER_NGS; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@0: RemoteIpAddress: 192.168.154.18; SessionId: 084939D4E097F41ACA6A1F24CD8390BE; Granted Authorities: ROLE_ADMIN_PROFILER_NGS
    14:48:32,861 DEBUG RoleHierarchyImpl:117 - getReachableGrantedAuthorities() - From the roles [ROLE_ADMIN_PROFILER_NGS] one can reach [ROLE_GUEST_PROFILER_NGS, ROLE_GUEST_PROFILER_CGH, ROLE_ADMIN_PROFILER_NGS, ROLE_GUEST] in zero or more steps.
    14:48:32,861 DEBUG AffirmativeBased:65 - Voter: org.springframework.security.access.vote.RoleHierarchyVoter@6ff43d69, returned: 0
    14:48:32,862 DEBUG RoleHierarchyImpl:117 - getReachableGrantedAuthorities() - From the roles [ROLE_ADMIN_PROFILER_NGS] one can reach [ROLE_GUEST_PROFILER_NGS, ROLE_GUEST_PROFILER_CGH, ROLE_ADMIN_PROFILER_NGS, ROLE_GUEST] in zero or more steps.
    14:48:32,862 DEBUG AffirmativeBased:65 - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@3fe932d5, returned: 1
    14:48:32,862 DEBUG FilterSecurityInterceptor:215 - Authorization successful</p>
  </blockquote>
  
  <p><strong><em>EDIT 5 :</em></strong> </p>
  
  <pre><code>     &lt;beans:bean id="login" class="com.clb.genomic.lyon.beans.LoginBean" scope ="session"&gt;
            &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt; 
       &lt;/beans:bean&gt;
  
  &gt;     &lt;security:authentication-manager alias="authenticationManager"&gt;
  &gt;         &lt;security:authentication-provider user-service-ref="userBo" &gt;
  &gt;             &lt;security:password-encoder ref="standardPasswordEncoder"/&gt;   
  &gt;         &lt;/security:authentication-provider&gt;
  &gt;     &lt;/security:authentication-manager&gt;
  </code></pre>