Spring Security MethodSecurityInterceptor - security

Question

I've got an Java application running on tomcat6.
I'm using spring 3.0.4 and spring security 3.0.5.
to protect the access of my dao methods i want to use the spring security MethodSecurityInterceptor. but this one doesn't actually "intercept" access at all.
It is configured like this:
<bean id="securityInterceptor" class="org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor">
<property name="authenticationManager">
<ref bean="authenticationManager"/>
</property>
<property name="accessDecisionManager">
<ref bean="accessDecisionManager"/>
</property>
<property name="securityMetadataSource">
<value>
com.xkst.dao.InvoiceDao.*=ROLE_ADMIN
com.xkst.dao.UserDao.*=ROLE_ADMIN
</value>
</property>
</bean>
According to the configuration every access of any of the methods of the UserDao should be intercepted an controlled.
The methods to be protected get accessed by a rich client Java application. To make the service available for the client I use the spring HttpInvokerServiceExporter.
The dao classes are not exported directly. there is a single serviceclass being exported providing a single point of access for the client.
On the client side I've got this clientContext.xml file which references the exported service on the server.
In the client code I just load the context and pick the exported bean out of it
public class SecurityTest {
public static void main(String[] args) {
ClassPathXmlApplicationContext ctx = new ClassPathXmlApplicationContext("clientContext.xml");
EntityServiceInterface serverService = (EntityServiceInterface) ctx.getBean("entityServiceInterface");
List<UserEntity> users = serverService.performGetAllUsers();
for(UserEntity user : users) {
System.out.println(user.getUserName());
}
}
here i can just invoke any method of the 'serverService' on my client which should be protected by the 'MethodSecurityInterceptor' without authenticating. I can query all data from my 'UserDao'.
I really don't know what the missing link is.
authenticationManager and accessDecisionManager are configured as well. there is no error message at the startup of the server. it even logs the creation of the "secured methods" like:
2011-08-01 10:38:48,675 INFO MethodDefinitionMap:75 - Adding secure method [public java.util.List com.xkst.dao.UserDao.findAll()] with attributes [[ROLE_ADMIN]]
So what am I doing wrong?