title: Define basic-security users, passwords and roles in application.yml
body: <p>I am looking for a way to secure methods with the <code>@Secured</code> annotation of Spring Boot. For about 10-15 users, I wouldn't want to connect to a database and obtain the users and their authorities/roles from there but rather store them locally in the profile-specific <code>application.yml</code> file. Is there a concept in Spring Boot supporting this idea? All I could find so far works with the basic security actuator (<code>'org.springframework.boot:spring-boot-starter-security'</code>) and looks like this:</p>
  
  <pre><code>security:
    basic:
      enabled: true
    user:
      name: admin
      password: admin
      role: EXAMPLE
  </code></pre>
  
  <p>However, I'm still able to access a method annotated with     <code>@RolesAllowed("READ")</code> even though I would assume that user <em>admin</em> shouldn't have access to said method. My SecurityConfiguration looks like this:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(jsr250Enabled = true)
  @Profile("secure")
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .anyRequest()
                  .fullyAuthenticated()
                  .and()
                  .httpBasic();
  
          http.sessionManagement()
                  .sessionFixation()
                  .newSession();
  
          http.csrf().disable();
          http.headers().frameOptions().disable();
  
      }
  }
  </code></pre>
  
  <p>Eventually this might be a different issue but maybe it's important for my own understanding. </p>
  
  <p>I'm wondering how I could specify multiple users with different passwords and different roles in my <code>application.yml</code> and annotate methods to ensure only authorized users can access the methods.</p>