403访问每次都拒绝Spring Security

Question

I am getting 403 on every request having pattern /admin I need to restrict /admin only for admin role.

Failed approach :

1. Tried using @PreAuthorize(hasRole('ADMIN')) and @PreAuthorize(hasRole('ROLE_ADMIN')) on controller but no luck.
2. Tried removing @PreAuthorize from controller and adding pattern in the below class with hasRole but no luck

Below is the class extends WebSecurityConfigurerAdapter

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()

                .antMatchers(HttpMethod.OPTIONS).permitAll()
              .antMatchers(HttpMethod.GET,"/admin/**").hasAnyRole("ADMIN","ADMIN_TENANT")
                .anyRequest().authenticated()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf()
                .disable();
        httpSecurity.
            addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        httpSecurity.
            headers().cacheControl().disable();
    }

Already tried solutions mentioned in similar question but no luck. So please don't mark it duplicate.

Answer 1

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()

                .antMatchers(HttpMethod.OPTIONS).permitAll()
              .antMatchers(HttpMethod.GET,"/admin/**").hasAnyRole("ADMIN","ADMIN_TENANT") // change hasAnyrole to hasAnyAuthority
                .anyRequest().authenticated()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf()
                .disable();
        httpSecurity.
            addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        httpSecurity.
            headers().cacheControl().disable();
    }

Answer 2

My similar Git Project : here

    // Config to check if already active
    http.authorizeRequests()
    .and() 
    .rememberMe()
    .tokenRepository(new JdbcTokenRepositoryImpl().setDataSource(//datasource_name) )
     .tokenValiditySeconds(//TimeInterval in sec); 

}