I am new to spring and trying to implement Role based authorization with the help of @Secured annotation. I have a method which is specifically for ADMIN and I have written @Secured ("ROLE_ADMIN") to secure it.

@Secured ("ROLE_ADMIN")
public void HelloUser(String name) {
System.out.println("Hello ADMIN");
}

Now when I call this method by creating a class object it gets called eventhough user dont have ADMIN authority But when I dont create an object and use @autowired annotation instead then it works i.e User is not allowed to access this method.

In my security.xml as well as servlet.xml I have added

<global-method-security secured-annotations="enabled" />

Can some one please tell me where I am going wrong or is this the natural behaviour in spring ?