Spring Security intercept URL不能用于自定义UserDetails对象

Question

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-4.1.xsd">

    <!-- enable use-expressions -->
    <http auto-config="true" use-expressions="true">

        <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />

        <!-- access denied page -->
        <access-denied-handler error-page="/403" />

        <session-management invalid-session-url="/login"
            session-fixation-protection="newSession">
            <concurrency-control max-sessions="1"
                error-if-maximum-exceeded="true" />
        </session-management>

        <form-login login-page="/login" authentication-failure-url="/login?error"
            username-parameter="emailId" password-parameter="pwd" />
        <logout logout-success-url="/login?logout" delete-cookies="JSESSIONID" />
        <csrf token-repository-ref="tokenRepository" />
    </http>

    <authentication-manager>
        <authentication-provider ref="customAuthenticationProvider" />
    </authentication-manager>

</beans:beans>

通过我的研究，我觉得上面的配置没有问题，但可能是因为我使用的自定义UserDetails对象造成的问题。这是POJO：

public class CustomUser implements UserDetails {

    private static final long serialVersionUID = 1L;
    private String userID;
    private String emailId;
    private String password;
    private boolean enabled = true;
    private boolean accountNonExpired = true;
    private boolean credentialsNonExpired = true;
    private boolean accountNonLocked = true;
    private List<Role> authorities;

    @Override
    public List<Role> getAuthorities() {
        return authorities;
    }
    //other setters and getters
}

角色类：

public class Role implements GrantedAuthority {

    private static final long serialVersionUID = 1L;
    private String name;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getAuthority() {
        return this.name;
    }
}

我还有一个自定义UserDAO类，用于填充CustomUser POJO，并且我已经验证了值设置中没有问题。

Principal: CustomUser [userID=user1, emailId=[e-mail], password=pwd, enabled=true, accountNonExpired=true, credentialsNonExpired=true, authorities=[Role [name=ADMIN]]];

Answer 1

改变了

<intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />

到

<intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />

编辑