Two instance of Spring Security in one EAR

[BloodyDark]

Hi everyone,

I need your help to handle an error when I try to deploy a application (EAR) that contains two wars with Spring Security configured.

Here is the architecture of my application :
Application.ear
|------ module1.war
|------ module2.war
|------ ejbs.jar

Spring Security is configured in the module1.war and module2.war in a applicationContext-security.xml and the context is loaded by the listener "org.springframework.web.context.ContextLoaderList ener".

But when I deploy the application on the server (JBoss 7.0.2), the second module throws an exception and is automatically un-deployed. But the first module is deployed correctly and Spring Security works.

Here is the stack trace :

10:21:35,133 INFO  [org.springframework.security.config.SecurityNamespaceHandler] (MSC service thread 1-3) Couldn't determine package version information.
10:21:35,135 GRAVE [org.springframework.web.context.ContextLoader] (MSC service thread 1-1) Context initialization failed: org.springframework.beans.factory.BeanDefinitionStoreException: Unexpected exception parsing XML document from ServletContext resource [/WEB-INF/applicationContext-security.xml]; nested exception is org.springframework.beans.FatalBeanException: Class [org.springframework.security.config.SecurityNamespaceHandler] for namespace [http://www.springframework.org/schema/security] does not implement the [org.springframework.beans.factory.xml.NamespaceHandler] interface
	at ...
Caused by: org.springframework.beans.FatalBeanException: Class [org.springframework.security.config.SecurityNamespaceHandler] for namespace [http://www.springframework.org/schema/security] does not implement the [org.springframework.beans.factory.xml.NamespaceHandler] interface
	at org.springframework.beans.factory.xml.DefaultNamespaceHandlerResolver.resolve(DefaultNamespaceHandlerResolver.java:126) [spring-beans-3.0.6.RELEASE.jar:]
	at ....
 
10:21:35,172 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/module2]] (MSC service thread 1-1) Exception lors de l'envoi de l'�v�nement contexte initialis� (context initialized) � l'instance de classe d'�coute (listener) org.springframework.web.context.ContextLoaderListener: org.springframework.beans.factory.BeanDefinitionStoreException: Unexpected exception parsing XML document from ServletContext resource [/WEB-INF/applicationContext-security.xml]; nested exception is org.springframework.beans.FatalBeanException: Class [org.springframework.security.config.SecurityNamespaceHandler] for namespace [http://www.springframework.org/schema/security] does not implement the [org.springframework.beans.factory.xml.NamespaceHandler] interface
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:412) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:302) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:143) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:178) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:149) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:124) [spring-web-3.0.6.RELEASE.jar:]
	at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:93) [spring-web-3.0.6.RELEASE.jar:]
	at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:130) [spring-context-3.0.6.RELEASE.jar:]
	at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:467) [spring-context-3.0.6.RELEASE.jar:]
	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:397) [spring-context-3.0.6.RELEASE.jar:]
	at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:282) [spring-web-3.0.6.RELEASE.jar:]
	at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:204) [spring-web-3.0.6.RELEASE.jar:]
	at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47) [spring-web-3.0.6.RELEASE.jar:]
	at org.apache.catalina.core.StandardContext.contextListenerStart(StandardContext.java:3368) [jbossweb-7.0.1.Final.jar:7.0.2.Final]
	at org.apache.catalina.core.StandardContext.start(StandardContext.java:3821) [jbossweb-7.0.1.Final.jar:7.0.2.Final]
	at org.jboss.as.web.deployment.WebDeploymentService.start(WebDeploymentService.java:70) [jboss-as-web-7.0.2.Final.jar:7.0.2.Final]
	at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1824)
	at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1759)
	at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) [:1.6.0_26]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) [:1.6.0_26]
	at java.lang.Thread.run(Thread.java:662) [:1.6.0_26]
Caused by: org.springframework.beans.FatalBeanException: Class [org.springframework.security.config.SecurityNamespaceHandler] for namespace [http://www.springframework.org/schema/security] does not implement the [org.springframework.beans.factory.xml.NamespaceHandler] interface
	at org.springframework.beans.factory.xml.DefaultNamespaceHandlerResolver.resolve(DefaultNamespaceHandlerResolver.java:126) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseCustomElement(BeanDefinitionParserDelegate.java:1333) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseCustomElement(BeanDefinitionParserDelegate.java:1328) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.parseBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:135) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.registerBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:93) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.registerBeanDefinitions(XmlBeanDefinitionReader.java:493) [spring-beans-3.0.6.RELEASE.jar:]
	at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:390) [spring-beans-3.0.6.RELEASE.jar:]
	... 21 more

And here is the content of applicationContext-security.xml :

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security.xsd
           http://www.springframework.org/schema/context
           http://www.springframework.org/schema/context/spring-context.xsd">
 
	<http auto-config="true" use-expressions="true">
		<form-login login-page="/login_jsf.xhtml" authentication-failure-url="/login_jsf.xhtml?error=1" />
	</http>
 
	<authentication-manager erase-credentials="false">
		<authentication-provider ref="daoAuthenticationProvider" />
	</authentication-manager>
 
	<beans:bean id="daoAuthenticationProvider" class="fr.monprojet.authentication.dao.MyAuthenticationProvider">
	    <beans:property name="userDetailsService" ref="MyUserDetailsServiceBean" />
	</beans:bean>
 
	<beans:bean id="MyUserDetailsServiceBean"
				class="fr.monprojet.authentication.service.MyUserDetailsService" />
</beans:beans>

In both module, the configuration is exactly the same, but when I deploy the EAR, the second module doesn't load correctly.

So my question is :
Is it possible to load two instances of Spring Security in two different modules, package in an EAR ?

I also try to add the Spring & Spring Security dependencies in the parent pom, but always the same problem.
(I found this document about a shared parent : http://blog.springsource.org/2007/06...g-application/ but I'm not sure that is what I need).

Thank a lot.
BloodyDark.

[Marten Deinum]

Ah the beauty of jboss class loading. Whilst you expect the wars to have separate class loaders they don't have this fully. Each war class loader can see all classes loaded by other wars, so when module 1 starts it loads the spring and spring security classes, module 2 starts also loads the classes, gets also some of module 1 and bingo class cast exceptions (class identity is based on class loader and classname not on classname alone!).

Put your shared jars in the ear and include them in the manifest of the war as needed dependency.