java - Spring Security @Secured annotation and User authorities -

this spring v.4 (mvc + security). have implemented userdetailsserviceimpl, inside loaduserbyusername method user granted authorities. it's simply:

public userdetails loaduserbyusername(string username) {     ...          collection<grantedauthority> authorities = new arraylist<>();      authorities.add(new simplegrantedauthority("admin"));      return new org.springframework.security.core.userdetails.user(username, password, enabled, true, true, true, authorities);     ... } 

and have security controller inside i've annotated method @secured annotation:

@secured("admin") @requestmapping(value = "/users", method = requestmethod.get) public string users(model model ...) { ... } 

as can see inside loaduserbyusername explicitly grant admin role user. when i'm trying access /users access denied exception:

2016-04-19 10:25:16,899 debug (http-nio-8080-exec-9) [org.springframework.security.web.access.exceptiontranslationfilter] - access denied (user not anonymous); delegating accessdeniedhandler org.springframework.security.access.accessdeniedexception: access denied @ org.springframework.security.access.vote.abstractaccessdecisionmanager.checkallowifallabstaindecisions(abstractaccessdecisionmanager.java:70) @ org.springframework.security.access.vote.affirmativebased.decide(affirmativebased.java:88) @ org.springframework.security.access.intercept.abstractsecurityinterceptor.beforeinvocation(abstractsecurityinterceptor.java:232) @ org.springframework.security.access.intercept.aopalliance.methodsecurityinterceptor.invoke(methodsecurityinterceptor.java:64) @ org.springframework.aop.framework.reflectivemethodinvocation.proceed(reflectivemethodinvocation.java:179) @ org.springframework.aop.framework.cglibaopproxy$dynamicadvisedinterceptor.intercept(cglibaopproxy.java:655) ...

(without @secured annotation works fine).

so, have missed here?

surprisingly, problem roles names. due defaultroleprefix set role_ (see org.springframework.security.access.vote.rolevoter class) roles should have names starting role_ prefix. in other words, when i've changed

authorities.add(new simplegrantedauthority("admin")); to

authorities.add(new simplegrantedauthority("role_admin"));

and @secured("admin") @secured("role_admin") - became fine.