@PreAuthorize, ACLs, spEL, and missing debug info

[rajani]

Hi,
I am also facing the same issue and moving the annotation to the impl works for me as well. But, I dont want to do that.
Any pointers on how I could get this working in the interface layer?

Thanks.

Thanks... I had already set those compiler settings, but that did not fix the problem.

What did fix it was moving the annotation...

@PreAuthorize("hasAnyRole('ROLE_SUPER_USER','ROLE_ SYSTEM_ADMIN') and hasPermission(#id, 'com.xyz.db.domain.impl.XyzConfigImpl', 'read')")
public XyzConfig get(Long id);

...from the interface to the class. I would prefer to put the method security annotation on the interfaces, but no big deal. I can move them back when this problem is fixed in a future release.

Note: it is only the presence of the expression's method parameter which prevents me from annotating the interface.

[Rob Winch]

Again I was unable to reproduce the issue, so I will need some more guidance on how to reproduce it. If you can come up with a dummy project that reproduces your issue that would be ideal.

[rajani]

Hi Rob,
Thanks for your response
I will try and put a sample app today.
Incase it helps, these are the steps.
0. I am deploying my app on virgo (3.0.3.RELEASE)
1. I have a core bundle which exposes a service and has @PreAuth anotations on the interface
2. A web bundle which uses this service.
3. After I deploy and try to load the url, I am getting the below exception.
[2012-08-24 12:04:29.178] INFO http-bio-8080-exec-3 System.out org.springframework.security.access.AccessDeniedEx ception: Access is denied
[2012-08-24 12:04:29.178] INFO http-bio-8080-exec-3 System.out 252881 [http-bio-8080-exec-3] ERROR c.w.HomeController - handleAccessDeniedException####Access is denied
(attached stack trace)
stacktrace.zip

[rajani]

what i just learnt is.. in the osgi context spring-security is not working.
1. when the authorize annotations are on interface, it always throws AccessDenied irrespective of the roles.
2. when the annotations are on impl, its allowing all users despite not having the role.

[rajani]

I used @preAuthorize annotations in one bundle and defined the global-security-bean in another bundle.
After I moved them to the same bundle It started working fine.

Hope this helps someone and saves some time.