Why is my custom PermissionEvaluator not working?

Question

I can’t understand why my security doesn’t work properly. Method hasPermission() in Evaluator class not even called. I think there is something wrong with my security config.

Answer 1

This is likely due to the fact that the tag needs to be in the same context as your Spring MVC configuration otherwise your controllers will not be post processed. This is discussed in the FAQ.

So for example, if your web.xml looks like the following:

    contextConfigLocation
    
        /WEB-INF/spring/*.xml
    



    springSecurityFilterChain
    org.springframework.web.filter.DelegatingFilterProxy



  springSecurityFilterChain
  /*




    org.springframework.web.context.ContextLoaderListener



    spring
    org.springframework.web.servlet.DispatcherServlet
    
        contextConfigLocation
        /WEB-INF/mvc/*.xml
    

To support method security on your controllers ensure the tag is defined in a location within /WEB-INF/mvc/*.xml. Note that the remainder of the configuration should remain where it is. If you want to support method security on your services, you likely also need in the parent (i.e. where it likely is now).

If this does not help, please post your web.xml or WebApplicationInitializer's if you are not using web.xml