Spring EL error

[zakhrim]

Hi everybody,
I'm new to the new Spring Security 3.
I'm trying to use expressions for configuraing access to my web app. This is my security configuration:

	<http auto-config="true" use-expressions="true" access-denied-page="/login/">
		<intercept-url pattern="/css/**" access="permitAll" />
		<intercept-url pattern="/js/**" access="permitAll" />
		<intercept-url pattern="/images/**" access="permitAll" />
		<intercept-url pattern="/secure/admin/**" access="hasRole('ROLE_ADMIN')"/>
		<intercept-url pattern="/*/secure/admin/**" access="hasRole('ROLE_ADMIN')"/>
		<intercept-url pattern="/secure/*" access="hasRole('ROLE_ADMIN','ROLE_USER')"/>
		<intercept-url pattern="/*/secure/*" access="hasRole('ROLE_ADMIN','ROLE_USER')"/>
		<intercept-url pattern="login*" access="permitAll" />
		<intercept-url pattern="/*" access="permitAll" />
		
		<form-login login-page="/login/" always-use-default-target="true"
			authentication-failure-url="/login/?login_error=1"
			default-target-url="/" login-processing-url="/login/j_spring_security_check/" />
		<logout invalidate-session="true" success-handler-ref="logoutSuccessHandler" />
		
	</http>

	<authentication-manager>
		<authentication-provider>
			<user-service>
				<user name="admin" password="admin123" authorities="ROLE_USER, ROLE_ADMIN" />
				<user name="user" password="user123" authorities="ROLE_USER" />
			</user-service>
		</authentication-provider>
	</authentication-manager>

Trying to access to a secured folder as an anonymous user (should result in redirect to login page) I get this error:

GRAVE: Servlet.service() for servlet [default] in context with path [/test2] threw exception
java.lang.IllegalArgumentException: Failed to evaluate expression 'hasRole('ROLE_ADMIN','ROLE_USER')'
	at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:13)
	at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:34)
	at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:50)
	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:204)
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)
	at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:177)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:168)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:240)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:164)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:462)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:164)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)
	at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:562)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
	at com.springsource.insight.collection.tcserver.request.HttpRequestOperationCollectionValve.invoke(HttpRequestOperationCollectionValve.java:84)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:395)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:250)
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:188)
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:166)
	at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:302)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
	at java.lang.Thread.run(Thread.java:662)
Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1004E:(pos 0): Method call: Method hasRole(java.lang.String,java.lang.String) cannot be found on org.springframework.security.web.access.expression.WebSecurityExpressionRoot type
	at org.springframework.expression.spel.ast.MethodReference.findAccessorForMethod(MethodReference.java:185)
	at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:107)
	at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:102)
	at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:97)
	at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11)
	... 49 more

I've found some posts here that suggested to check dependencies but they look correct:

spring-webflow : 2.3.0.RELEASE
spring-security-taglibs : 3.0.7.RELEASE
spring-security-config : 3.0.7.RELEASE

(and then maven adds the related dependencies).

Any ideas?
Thanks,
Stefano

[zakhrim]

Stupid me.
I misunderstood the documentation...
Instead of

hasRole('ROLE_USER, ROLE_ADMIN')

I used

hasRole('ROLE_USER','ROLE_ADMIN')

Bye,
Stefano