Define basic-security users, passwords and roles in application.yml
<p>I am looking for a way to secure methods with the <code>@Secured</code> annotation of Spring Boot. For about 10-15 users, I wouldn't want to connect to a database and obtain the users and their authorities/roles from there but rather store them locally in the profile-specific <code>application.yml</code> file. Is there a concept in Spring Boot supporting this idea? All I could find so far works with the basic security actuator (<code>'org.springframework.boot:spring-boot-starter-security'</code>) and looks like this:</p>

<pre><code>security:
  basic:
    enabled: true
  user:
    name: admin
    password: admin
    role: EXAMPLE
</code></pre>

<p>However, I'm still able to access a method annotated with     <code>@RolesAllowed("READ")</code> even though I would assume that user <em>admin</em> shouldn't have access to said method. My SecurityConfiguration looks like this:</p>

<pre><code>@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(jsr250Enabled = true)
@Profile("secure")
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest()
                .fullyAuthenticated()
                .and()
                .httpBasic();

        http.sessionManagement()
                .sessionFixation()
                .newSession();

        http.csrf().disable();
        http.headers().frameOptions().disable();

    }
}
</code></pre>

<p>Eventually this might be a different issue but maybe it's important for my own understanding. </p>

<p>I'm wondering how I could specify multiple users with different passwords and different roles in my <code>application.yml</code> and annotate methods to ensure only authorized users can access the methods.</p>