Spring Security roles are not working - spring

Question

I have configured spring security in my app,authentication is working well but authorization is not working mean #secured() annotation is not working.i am getting error when i access url "There was an unexpected error (type=Forbidden, status=403).
Access is denied".
My spring config is
#Autowired
private MongoDBAuthenticationProvider authenticationProvider;
#Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/js/**", "/css/**");
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.formLogin().defaultSuccessUrl("/resource")
.and().logout().and().authorizeRequests()
.antMatchers("/logout").permitAll()
.antMatchers("/admin/**").hasRole("ADMIN")
.anyRequest()
.authenticated()
.and().csrf().disable();
}
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authenticationProvider);
}
My controller is
#RestController
#RequestMapping("/user")
public class UserController {
#Autowired
UserService userService;
#Secured(value={"ROLE_ADMIN"})
#RequestMapping(value = "/{id}", method = RequestMethod.GET)
public void getUser() {
System.out.println("working");
}
}
Database user is
{ "_id" : ObjectId("555982a5360403572551660c"), "username" : "user", "password" : "pass", "role" : "ADMIN" }
My mongodb auth provider
#Service
public class MongoDBAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{
#Autowired
MongoUserDetailsService mongoUserDetailsService;
#Autowired MongoTemplate mongoTemplate;
#Override
protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
}
#Override
protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
UserDetails loadedUser;
try {
loadedUser = mongoUserDetailsService.loadUserByUsername(username);
} catch (Exception repositoryProblem) {
throw new InternalAuthenticationServiceException(repositoryProblem.getMessage(), repositoryProblem);
}
if (loadedUser == null) {
throw new InternalAuthenticationServiceException(
"UserDetailsService returned null, which is an interface contract violation");
}
return loadedUser;
}
}
User domain
public class User {
#Id
private String id;
#NotNull
private String name;
private int age;
private String username;
private String password;
private String role;
public User() {
super();
}
public User(String name,String username,
String password, String role) {
super();
this.name = name;
this.username = username;
this.password = password;
this.role = role;
}
public String getId() {
return id;
}
public void setId(String id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
public int getAge() {
return age;
}
public void setAge(int age) {
this.age = age;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String getRole() {
return role;
}
public void setRole(String role) {
this.role = role;
}
}

Answer 1

Add this bean in Spring Security Config File
#Bean
public RoleVoter roleVoter() {
RoleVoter roleVoter = new RoleVoter();
roleVoter.setRolePrefix("");
return roleVoter;
}
And write secured annotation like this
#Secured(value={"ADMIN"})

Answer 2

#Secured(value={"ADMIN"})
Instead of
#Secured(value={"ROLE_ADMIN"})
You also could try
#PreAuthorize("hasRole('ADMIN')")
If #Secured annotation still doesn't work