spring boot security with mongodb PostAuthorize and PreAuthorize not working

Question

Authentication is working but not the authorization. Please help I'm unable to find what's going wrong.

Controller

@RestController
@RequestMapping("/v1/user")
public class UserController {

    @PostAuthorize("hasRole('ROLE_ADMIN')") //@PreAuthorize("hasRole('ROLE_ADMIN')"), both are not working
    @RequestMapping(method = RequestMethod.DELETE)
    @ResponseStatus(HttpStatus.NO_CONTENT)
    public void deleteUser() {
        log.debug("Only Admin can access this");

        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        System.out.println("User name "+auth.getName()); //prints - User name pratap
        System.out.println("User Authorities "+auth.getAuthorities()); // prints - User Authorities [ADMIN]
    }
}

SecurityConfiguration.java

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomUserDetailsService customUserDetailsService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().anyRequest().fullyAuthenticated().and().
                httpBasic().and().
                csrf().disable();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailsService);
    }
}

CustomUserDetailsService.java

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username);
        System.out.println("username "+user.getUsername());
        if(user != null) {
            return new org.springframework.security.core.userdetails.User(user.getUsername(), user.getPassword(), true, true, true, true,
                    AuthorityUtils.createAuthorityList("ADMIN"));
        } else {
            throw new UsernameNotFoundException("could not find the user '"
                    + username + "'");
        }
    }
}

Error:

{
  "timestamp": 1472789456591,
  "status": 403,
  "error": "Forbidden",
  "message": "Access is denied",
  "path": "/v1/user/pratap"
}

Answer 1

I got it. While adding roles it should be prefixed with "ROLE_"

AuthorityUtils.createAuthorityList("ROLE_ADMIN", "ROLE_USER"));

and in @PreAuthorize, it should be without prefix "ROLE_"

@PreAuthorize("hasRole('ADMIN')")