Possible bug in PathBasedFilterInvocationDefinitionMap

[adepue]

This is either a bug or a misunderstanding on my part. I have a FilterSecurityInterceptor defined for my web site with an objectDefinitionSource in my Spring config that contains something along these lines:

  <bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
    <property name="authenticationManager"><ref bean="authenticationManager"/></property>
    <property name="accessDecisionManager"><ref bean="httpRequestAccessDecisionManager"/></property>
    <property name="runAsManager"><ref bean="runAsManager"/></property>
    <property name="objectDefinitionSource">
      <value>
        CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
        PATTERN_TYPE_APACHE_ANT
        ...
        /somepath/somesubpath/SpecificPage=
        /somepath/**=ROLE_USER
      </value>
    </property>
  </bean>

Basically what I'm trying to accomplish is to secure (require a login) for all content below /somepath/** EXCEPT for the specific page /somepath/somesubpath/SpecificPage (hence, the empty role list). I did a quick look at the source code and it appears this should work except that PathBasedFilterInvocationDefinitionMap has this line in the addSecureUrl method:

        if (logger.isDebugEnabled()) {
            logger.debug("Added Ant path: " + antPath + "; attributes: "
                + attr.toString());
        }

However, since I have an empty role list on the right hand side of my path the "ConfigAttributeDefinition attr" parameter is null at this point, so I get a NullPointerException.
Is this a bug, or should I be approaching the issue differently?

Thanks,
Andy

[Ben Alex]

Hi Andy

I intend to address this in the long-term by having an anonymous user, which can have GrantedAuthority[]s automatically assigned. As such your filter could require ROLE_ANONYMOUS (granted to the anonymous user) and it would work.

In the meantime, this approach is probably best: http://forum.springframework.org/showthread.php?t=11996