Global method security in Spring Boot

Question

I'm having some issues when trying to enable the global method security in a Spring Boot application. More or less I've this configuration:

@ComponentScan
@Configuration
@EnableAutoConfiguration
@EnableConfigurationProperties
public class Main extends SpringBootServletInitializer {

    public static void main(String[] args) throws Exception {
        SpringApplication app = new SpringApplication(Main.class);
        app.setShowBanner(false);
        ApplicationContext context = app.run(args);
    }

    @Override
    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
        return application.sources(Main.class);
    }
}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, proxyTargetClass = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        ...
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        ...
    }
}

@Controller
public class SampleController {

    @RequestMapping("/api/hello")
    @ResponseBody
    String hello() {
        return "Hello!";
    }

    @Secured(SecurityGrant.WRITE_PROJECT)
    @RequestMapping("/api/bye")
    @ResponseBody
    String bye() {
        return "Bye!";
    }
}

The @Secure annotations are working OK at services, but not in controllers, so as I read here (http://docs.spring.io/spring-security/site/faq/faq.html#faq-method-security-in-web-context) I think is because method security is only configured in the root application context and not in the one for the servlet. However, I can't find the way to set this via Java Configuration, instead of using a web.xml file. Any ideas?

Update:

As pointed in the comments, methods should be public to be proxied.

Answer 1

The controller methods need to be public in order to be proxied for @Secured. Just doing that should fix it.

Answer 2

In XML you would have to define a second global-method-security in the servlet-context.xml file. This is because there are two contexts, the root context and the web context and security needs to be configured in each separately.

In Java config, try to create a separate web configuration class, and mark it with @EnableWebMvc:

@Configuration
@EnableWebMvc
@EnableGlobalMethodSecurity(securedEnabled = true, proxyTargetClass = true)
public class WebConfig {
    ...
}