Roles de usuario Spring Data Rest Spring security

Tengo un error que realmente no entiendo. No encontré ningún tutorial que explique por qué no funciona. Tengo esta aplicación de arranque de primavera con seguridad de primavera.

Cuando hago esta solicitud POST: http://localhost:8181/roles cuerpo:

{
    "name":"ROLE_USER"
} 

funciona bien.

Cuando hago esta solicitud POST: http://localhost:8181/users cuerpo:

 {
    "username":"user",
    "password":"pass",
    "roles":[
      "http://localhost:8181/roles/1"
    ]
} 

funciona bien

Pero cuando hago esta solicitud GET: http://localhost:8181/users con las credenciales correctas (nombre de usuario: usuario, contraseña: contraseña)

vuelve :

{
  "timestamp": "2020-04-22T15:04:55.032+0000",
  "status": 403,
  "error": "Forbidden",
  "message": "Forbidden",
  "path": "/users"
}

No sé por qué devuelve un 403.

PD: Todas las solicitudes se realizan en Postman

UnoApplication.java

package com.example.Uno;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@SpringBootApplication
public class UnoApplication {

    @Bean
    public PasswordEncoder passwordEncoder(){
        return NoOpPasswordEncoder.getInstance();
    }

    public static void main(String[] args) {
        SpringApplication.run(UnoApplication.class, args);
    }
}

User.java

package com.example.Uno.entity;

import lombok.Data;

import javax.persistence.*;
import java.io.Serializable;
import java.util.*;

@Data
@Entity

public class User implements Serializable {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String username;
    private String password;


    @ManyToMany(mappedBy = "users",targetEntity = Role.class,cascade = {CascadeType.MERGE,CascadeType.PERSIST}, fetch = FetchType.EAGER)
    private Set<Role> roles = new HashSet<>();


}

Role.java

package com.example.Uno.entity;

import lombok.Data;

import javax.persistence.*;
import java.io.Serializable;
import java.util.*;

@Data
@Entity

public class Role implements Serializable {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String name;

    @ManyToMany(cascade = {CascadeType.MERGE,CascadeType.PERSIST}, fetch = FetchType.LAZY)
    private Set<User> users = new HashSet<>();


}

MyUserDetails.java

package com.example.Uno.entity;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.Collection;
import java.util.List;


public class MyUserDetails implements UserDetails {

    private String username;
    private String password;
    private List<GrantedAuthority> grantedAuthorities;

    public MyUserDetails(com.example.Uno.entity.User user){
        this.username = user.getUsername();
        this.password = user.getPassword();
        for (Role r: user.getRoles()){
            grantedAuthorities.add(new SimpleGrantedAuthority(r.getName()));
        }

    }


    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return grantedAuthorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return username;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }
}

UserRepository.java

package com.example.Uno.repository;


import com.example.Uno.entity.User;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.rest.core.annotation.RepositoryRestResource;

import java.util.Optional;


@RepositoryRestResource
public interface UserRepository extends JpaRepository<User,Long> {

    User findUserByUsername(String s);

}

RoleRepository.java

package com.example.Uno.repository;

import com.example.Uno.entity.Role;
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.rest.core.annotation.RepositoryRestResource;

@RepositoryRestResource
public interface RoleRepository extends JpaRepository<Role,Long> {
    Role findRoleByName(String name);
}

MyUserDetailsService.java

package com.example.Uno.service;

import com.example.Uno.entity.MyUserDetails;
import com.example.Uno.entity.User;
import com.example.Uno.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;


@Service
public class MyUserDetailsService implements UserDetailsService {
    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {

        User user = userRepository.findUserByUsername(s);
        return new MyUserDetails(user);
    }
}

SecurityConfig.java

package com.example.Uno.config;

import com.example.Uno.service.MyUserDetailsService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private MyUserDetailsService myUserDetailsService;

    @Autowired
    private PasswordEncoder passwordEncoder;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(myUserDetailsService).passwordEncoder(passwordEncoder);
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers(HttpMethod.POST,"/users");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests()
                .antMatchers("/users").hasRole("USER")
                .anyRequest().permitAll().and().httpBasic();
    }
}

Gracias por tu tiempo.

EDITAR

Agregué esta línea en mi application.properties: logging.level.org.springframework.security = DEBUG

y cuando hago la solicitud GET anterior, se ve así en el backend: Spring part 2 User Role

Entonces, basado en el registro

[email protected]; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Not granted any authorities'

Sus detalles de usuario no tenían ninguna autoridad, lo que significa que el método: findUserByUserName no obtuvo ningún rol en el objeto de usuario. O necesita consultar el rol por separado con su otra función: findRoleByName (), y configurarlo en los detalles del usuario.

¡Estás en la dirección correcta y muy cerca del triunfo!