AccessDecisionManager of GlobalMethodSecurityConfiguration is not MessageSourceAware

https://github.com/spring-projects/spring-security/blob/c24490cbb875d6155ecd4ca5fcff6a1e35d47ae1/config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java#L259

AffirmativeBased access decision manager which is used in GlobalMethodSecurityConfiguration is created by accessDecisionManager() method and it is not a Spring bean. As a result, setMessageSource() method gets never executed which makes this access decision manager not MessageSourceAware although AffirmativeBased implements MessageSourceAware interface. This avoids customizing spring security access denied messages generated by @PreAuthorize annotation.

The solution for that is to set the messageSource manually like below;

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

    @Autowired
    private MessageSource messageSource;

    @Override
    protected AccessDecisionManager accessDecisionManager() {
        AffirmativeBased manager = (AffirmativeBased) super.accessDecisionManager();
        manager.setMessageSource(messageSource);
        return manager;
    }

}

Just for reference, this issue doesn't apply to the access decision manager of AbstractInterceptUrlConfigurer where messageSource is set during postProcess.

This problem is also mentioned in this stackoverflow post.

Start in config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java at accessDecisionManager(), then compare the message-source handling described for AbstractInterceptUrlConfigurer. Done means the AffirmativeBased manager used by global method security receives the MessageSource so customized access-denied messages from @PreAuthorize are effective.