Spring security 4 @PreAuthorize(hasAuthority()) access denied
<p>I am trying to convert a Spring Security 3 @Secured("admin") annotation into Spring Security 4 compatible fashion.</p>

<p>This is my <code>usersService.java</code></p>

<pre><code>@PreAuthorize("hasAuthority('admin')")
public List&lt;User&gt; getAllUsers() {
    return usersDao.getAllUsers();
}
</code></pre>

<p>Then in <code>security-context.xml</code> I have:</p>

<pre><code>&lt;security:intercept-url pattern="/admin" access="permitAll" /&gt;
...
&lt;security:global-method-security pre-post-annotations="enabled" /&gt;
</code></pre>

<p><code>getAllUsers()</code> is called by a <code>LoginController.java</code></p>

<pre><code>@RequestMapping("/admin")
public String showAdmin(Model model) {
    List&lt;User&gt; users = usersService.getAllUsers();

    model.addAttribute("users", users);

    return "admin";
}
</code></pre>

<p>In mySql database, there are two tables, users and authorities. <code>authorities</code> has 2 columns, username and authority. <code>administrator</code> has authority <code>admin</code>.</p>

<p>Now if I trie to access <code>/admin</code>, I will be redirected to <code>/login</code>, but after I log in with <code>administrator</code>, I still get "access denied".</p>

<p>I think I must have missed something very basic but as I am new to Spring, I could not figure it out. Any help would be appreciated. Thanks.</p>

<p>Update: I tried changing the annotation to @PreAuthorize("hasRole('ROLE_ADMIN')") and I also changed the "authority" column in mySql for admin from "admin" to "ROLE_ADMIN" but it still gives me 403. I did not have much faith on this because before this error, I had to change <code>hasRole('admin')</code> in <code>securityContext.xml</code> to <code>hasAuthority('admin')</code>.</p>