title: Role based spring security on REST API
body: <p>I followed this code base to implement spring security <a href="https://github.com/brahalla/Cerberus" rel="nofollow">https://github.com/brahalla/Cerberus</a></p>
  
  <p>I have resource secured after i configured my security like </p>
  
  <pre><code>@Override
      protected void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity
                  .csrf()
                  .disable()
                  .exceptionHandling()
                  .authenticationEntryPoint(this.unauthorizedHandler)
                  .and()
                  .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                  .and()
                  .authorizeRequests()
                  .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                  .antMatchers("/auth/**").permitAll()
                  .anyRequest().authenticated();
  
          // Custom JWT based authentication
          httpSecurity
                  .addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
      }
  </code></pre>
  
  <p>Now, i can access <code>/auth</code> to generate the token. Then i created a resource like thi s</p>
  
  <pre><code>@RequestMapping(value = "/api", method = GET)
  @PreAuthorize("hasRole('ADMIN')")
  ResponseEntity&lt;?&gt; sayHello() {
      return new ResponseEntity&lt;&gt;("Hello", OK);
  }
  </code></pre>
  
  <p>and i have hard-coded user defined like this </p>
  
  <pre><code>@Service
  public class UserDetailsServiceImpl implements UserDetailsService {
  
      @Override
      public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
          User user = new User();
          user.setId(1L);
          user.setAuthorities(Roles.ADMIN.name());
          user.setEmail("a@a.com");
          user.setPassword(getEncryptedPass("admin"));
          user.setUsername("hola");
          return CerberusUserFactory.create(user);
      }
  
      private String getEncryptedPass(String admin) {
          PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
          return passwordEncoder.encode(admin);
      }
  
  
  }
  </code></pre>
  
  <p>However, whenever i try to access the <code>api</code> with <code>X-Auth-Token</code> in the header (with generate toke as its value) i am still getting <code>403</code> (Access Forbidden). What i am missing here ?</p>
  
  <p><em>P.S</em>: I have already tried <code>hasRole('Admin')</code> to <code>hasRole('ROLE_ADMIN')</code> ... it didn't work</p>