config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java
@Bean
	public MethodSecurityMetadataSource methodSecurityMetadataSource() {
		List<MethodSecurityMetadataSource> sources = new ArrayList<>();
		ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory(
				getExpressionHandler());
		MethodSecurityMetadataSource customMethodSecurityMetadataSource = customMethodSecurityMetadataSource();
		if (customMethodSecurityMetadataSource != null) {
			sources.add(customMethodSecurityMetadataSource);
		}

		boolean hasCustom = customMethodSecurityMetadataSource != null;
		boolean isPrePostEnabled = prePostEnabled();
		boolean isSecuredEnabled = securedEnabled();
		boolean isJsr250Enabled = jsr250Enabled();

		if (!isPrePostEnabled && !isSecuredEnabled && !isJsr250Enabled && !hasCustom) {
			throw new IllegalStateException("In the composition of all global method configuration, " +
					"no annotation support was actually activated");
		}

		if (isPrePostEnabled) {
			sources.add(new PrePostAnnotationSecurityMetadataSource(attributeFactory));
		}
		if (isSecuredEnabled) {
			sources.add(new SecuredAnnotationSecurityMetadataSource());
		}
		if (isJsr250Enabled) {
			GrantedAuthorityDefaults grantedAuthorityDefaults =
					getSingleBeanOrNull(GrantedAuthorityDefaults.class);
			Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource = this.context.getBean(Jsr250MethodSecurityMetadataSource.class);
			if (grantedAuthorityDefaults != null) {
				jsr250MethodSecurityMetadataSource.setDefaultRolePrefix(
						grantedAuthorityDefaults.getRolePrefix());
			}
			sources.add(jsr250MethodSecurityMetadataSource);
		}
		return new DelegatingMethodSecurityMetadataSource(sources);
	}
@Bean
	public MethodSecurityMetadataSource methodSecurityMetadataSource() {
		List<MethodSecurityMetadataSource> sources = new ArrayList<>();
		ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory(
				getExpressionHandler());
		MethodSecurityMetadataSource customMethodSecurityMetadataSource = customMethodSecurityMetadataSource();
		if (customMethodSecurityMetadataSource != null) {
			sources.add(customMethodSecurityMetadataSource);
		}

		boolean hasCustom = customMethodSecurityMetadataSource != null;
		boolean isPrePostEnabled = prePostEnabled();
		boolean isSecuredEnabled = securedEnabled();
		boolean isJsr250Enabled = jsr250Enabled();

		if (!isPrePostEnabled && !isSecuredEnabled && !isJsr250Enabled && !hasCustom) {
			throw new IllegalStateException("In the composition of all global method configuration, " +
					"no annotation support was actually activated");
		}

		if (isPrePostEnabled) {
			sources.add(new PrePostAnnotationSecurityMetadataSource(attributeFactory));
		}
		if (isSecuredEnabled) {
			sources.add(new SecuredAnnotationSecurityMetadataSource());
		}
		if (isJsr250Enabled) {
			GrantedAuthorityDefaults grantedAuthorityDefaults =
					getSingleBeanOrNull(GrantedAuthorityDefaults.class);
			Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource = this.context.getBean(Jsr250MethodSecurityMetadataSource.class);
			if (grantedAuthorityDefaults != null) {
				jsr250MethodSecurityMetadataSource.setDefaultRolePrefix(
						grantedAuthorityDefaults.getRolePrefix());
			}
			sources.add(jsr250MethodSecurityMetadataSource);
		}
		return new DelegatingMethodSecurityMetadataSource(sources);
	}
@ Bean public MethodSecurityMetadataSource methodSecurityMetadataSource ( ) { List < MethodSecurityMetadataSource > sources = new ArrayList <> ( ) ; ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory ( getExpressionHandler ( ) ) ; MethodSecurityMetadataSource customMethodSecurityMetadataSource = customMethodSecurityMetadataSource ( ) ; if ( customMethodSecurityMetadataSource != null ) { sources . add ( customMethodSecurityMetadataSource ) ; } boolean hasCustom = customMethodSecurityMetadataSource != null ; boolean isPrePostEnabled = prePostEnabled ( ) ; boolean isSecuredEnabled = securedEnabled ( ) ; boolean isJsr250Enabled = jsr250Enabled ( ) ; if ( ! isPrePostEnabled && ! isSecuredEnabled && ! isJsr250Enabled && ! hasCustom ) { throw new IllegalStateException ( "In the composition of all global method configuration, " + "no annotation support was actually activated" ) ; } if ( isPrePostEnabled ) { sources . add ( new PrePostAnnotationSecurityMetadataSource ( attributeFactory ) ) ; } if ( isSecuredEnabled ) { sources . add ( new SecuredAnnotationSecurityMetadataSource ( ) ) ; } if ( isJsr250Enabled ) { GrantedAuthorityDefaults grantedAuthorityDefaults = getSingleBeanOrNull ( GrantedAuthorityDefaults . class ) ; Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource = this . context . getBean ( Jsr250MethodSecurityMetadataSource . class ) ; if ( grantedAuthorityDefaults != null ) { jsr250MethodSecurityMetadataSource . setDefaultRolePrefix ( grantedAuthorityDefaults . getRolePrefix ( ) ) ; } sources . add ( jsr250MethodSecurityMetadataSource ) ; } return new DelegatingMethodSecurityMetadataSource ( sources ) ; }
Provides the default {@link MethodSecurityMetadataSource} that will be used. It
creates a {@link DelegatingMethodSecurityMetadataSource} based upon
{@link #customMethodSecurityMetadataSource()} and the attributes on
{@link EnableGlobalMethodSecurity}.

@return the {@link MethodSecurityMetadataSource}
Provides the default { @link MethodSecurityMetadataSource } that will be used . It creates a { @link DelegatingMethodSecurityMetadataSource } based upon { @link #customMethodSecurityMetadataSource () } and the attributes on { @link EnableGlobalMethodSecurity } .