Plugin is failing to evaluate role names without a ROLE_* prefix

[emmanuj]

Role names without the ROLE_* prefix fails with the following exception:

Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E: Property or field 'USER_ROLE' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot' - maybe not public?
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:224)
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:94)
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:81)
        at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:131)
        at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:299)
        at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:26)
        ... 65 common frames omitted

Looks like Burt is already aware of the issue as per this StackOverflow response. Opening this issue to track it.

[ddelponte]

Thanks for creating this issue @emmanuj !

I've pasted @burtbeckwith 's stackoverflow comment below for completeness:

A recent release bumped the version of the Spring Security jars to 4.0.x which changed the way the role name prefix is overridden. Your role names don't start with "ROLE_" so they're not detected as roles. Thus they're assumed to be a SpEL expression, and you're seeing a failure to evaluate 'ADMIN' as an expression.

The straightforward workaround would be to rename all role names so they start with "ROLE_" until the plugin is again in sync with Spring Security.

[ddelponte]

This does not appear to be bug. It's working the way Spring intended.

Per the documentation:

The prefix can be changed by setting the rolePrefix property of RoleVoter. If you only need to use roles in your application and have no need for other custom voters, then you can set the prefix to a blank string, in which case the RoleVoter will treat all attributes as roles.

More information available at:

• https://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-jc.html#m3to4-role-prefixing-disable
• https://docs.spring.io/spring-security/site/docs/5.0.6.RELEASE/reference/htmlsingle/#appendix-faq-role-prefix
• https://stackoverflow.com/questions/33205236/spring-security-added-prefix-role-to-all-roles-name
• https://stackoverflow.com/questions/20787590/spring-security-roles-should-always-be-prefixed-with-role

I will close this and mark it as "Not a bug"