I’ve defined three entities: User, Job, Profile, and an enumeration UserType.

I created an AdminController for REST APIs to post jobs, return all users, return a job by specific ID, return a user by specific ID, etc. All admin endpoints are authenticated and authorized for users with the admin role only. I predefined two users in my UserService class.

The issue I’m encountering is that when I try to access one of the admin endpoints (“/admin/applicants”) through Postman, I’m getting a 403 Forbidden error even after authenticating with the credentials username:Admin and password:Admin.

Security cofig file

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
    @Autowired
    private final UserDetailsService userDetailsServiceImp;


    public SecurityConfig(UserDetailsService userDetailsServiceImp) {
        this.userDetailsServiceImp = userDetailsServiceImp;
    }


    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.cors(AbstractHttpConfigurer::disable).csrf(AbstractHttpConfigurer::disable).authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/signup", "/login", "/jobs")
                            .permitAll()
                            .requestMatchers("/admin/**").hasRole("ADMIN")
                            .requestMatchers( "/uploadResume").hasRole("APPLICANT")
                            .anyRequest().authenticated();
                }).userDetailsService(userDetailsServiceImp)
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        return http.build();
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

Admin controller file

@RestController
public class AdminController {
    @Autowired
    private JobService jobService;
    @Autowired
    private UserRepository userRepository;

    
    @PostMapping("/admin/job")
    public ResponseEntity<?> createJob(@RequestBody Job job) {
        Job createdJob = jobService.saveJob(job);
        return ResponseEntity.ok(createdJob);
    }

    
    @GetMapping("/admin/job/{id}")
    public ResponseEntity<?> getJobById(@PathVariable Long id) {
        Job job = jobService.findJobById(id);
        if (job == null) {
            return ResponseEntity.notFound().build();
        }
        return ResponseEntity.ok(job);
    }

    
    @GetMapping("/admin/applicants")
    public ResponseEntity<List<User>> getAllApplicants() {
        List<User> applicants = userRepository.findAll();
        return ResponseEntity.ok(applicants);
    }

    
    @GetMapping("/admin/applicant/{id}")
    public ResponseEntity<?> applicantId(@PathVariable Long id) {
        Optional<User> optionalUser = userRepository.findById(id);
        if (optionalUser.isPresent()) {
            User user = optionalUser.get();
            Long userId = user.getUserId();
            return ResponseEntity.ok().body(userId);
        } else {
            return ResponseEntity.notFound().build();
        }
    }
}

User service file

@Service
public class UserService {
    @Autowired
    private UserRepository userRepository;

    @Autowired
    private PasswordEncoder passwordEncoder;


    public User registerUser(User user) {
        User savedUser = userRepository.save(user);
        savedUser.setPasswordHash(passwordEncoder.encode(savedUser.getPasswordHash()));


        User user1 = new User();
        user1.setUserName("Admin");
        user1.setPasswordHash(passwordEncoder.encode("Admin"));
        user1.setRole(UserType.ADMIN);

        User user2 = new User();
        user2.setUserName("Applicant");
        user2.setPasswordHash(passwordEncoder.encode("Applicant"));
        user2.setRole(UserType.APPLICANT);


        userRepository.save(user1);
        userRepository.save(user2);


        return savedUser;
    }

    public User findByEmail(String email) {
        return userRepository.findByEmail(email);
    }

    public Optional<User> findByUserName(String userName){
        return userRepository.findByUserName(userName);
    }
}

User detail service implementation

@Service
public class UserDetailsServiceImp implements UserDetailsService {
    @Autowired
    private final UserRepository userRepository;

    public UserDetailsServiceImp(UserRepository userRepository) {
        this.userRepository = userRepository;
    }


    @Override
    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
        return userRepository.findByUserName(userName)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
    }
}

Postman error of 403 after authenticating

Tried adding @PreAuthroize annotation in some endpoints but still didnt work.
@PreAuthorize("hasRole('ADMIN')")

I’m only able to access the endpoint when i remove all the security configurations.