How to integrate Spring Security for Role based url/method access
<p>I need to provide role based access for my REST APIs and I have seen that we could use <code>@PreAuthorize, @Secured</code> for this. However I am not sure as to what changes should I make and get this in place as currently I use a <code>custom token based authentication mechanism</code> generate a token for a session and handle it myself.</p>

<pre><code>  @RequestMapping(value = "login", method = RequestMethod.POST)
        public @ResponseBody Result login(@RequestBody Credentials credentials) {
        return loginService.login(credentials.getUsername(), credentials.getPassword());
        }
</code></pre>

<p>The Result class just contains a generated token for the user which he will be passing on each request.</p>

<p>Now any idea what changes should I make to restrict the access of an API if the user is in particular role</p>

<p>For example if I want to restrict the API <code>findById</code> to be accessed by user only if he is part of <code>ADMIN_ROLE</code> then I will have to add the <code>PreAuthorize</code> annotation but am not sure how will this determine the user role and block the user automatically.</p>

<pre><code>@PreAuthorize("ADMIN_ROLE")
@RequestMapping(value = "{id}", method = RequestMethod.GET)
public @ResponseBody Group findById(@PathVariable int id) {
    return groupParser.getGroupById(id, groupService.getGroupTree());
}
</code></pre>