How to make 'access' attribute of intercept url in spring security dynamic?

[mirnav]

I have an intercept url pattern as follows:

<intercept-url pattern="/messageList*" access="ROLE_USER" />

I need to know how to make the values for access attribute(ie access="ROLE_USER") dynamically from database?

[objectamit]

You should be able to do this via Spel as in

<intercept-url pattern="/messageList*" access="#{@dbService.allowedRolesForMessageList}" />

where dbService is the name of the service bean which populates a list of roles from DB

[mirnav]

You should be able to do this via Spel as in
where dbService is the name of the service bean which populates a list of roles from DB

Whether "allowedRolesForMessageList" method should return List values only?

[objectamit]

Again, that depends. As there's Spel to interpret in-between, therefore if you have a custom converter registered in context which takes a List<String> or String as Input and provides a List<GrantedAuthority> as output, then you may get away by returning only string containing comma-seperated values of various role-names.

Point is, with Spel, there're a lot of options available to you. Its just a matter of thinking and leading Spel to what you want it to do

[mirnav]

I have created a method in my service implementation class which returns a string as follows :

public synchronized String returnStringMethod()
{
return "ROLE_ADMIN,ROLE_USER";
}

And in my applicationContext-security.xml file i have written like this:

<intercept-url pattern="/messageDelete*" access="#{messageBoardService.returnStringMethod}" />

But I am getting the exception as :

org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name 'org.springframework.security.web.access.intercept .FilterSecurityInterceptor#0': Cannot create inner bean '(inner bean)' of type [org.springframework.security.web.access.intercept. DefaultFilterInvocationSecurityMetadataSource] while setting bean property 'securityMetadataSource'; nested exception is org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name '(inner bean)#5': Cannot create inner bean '(inner bean)' of type [org.springframework.security.access.SecurityConfig] while setting constructor argument with key [Root bean: class [org.springframework.security.web.access.intercept. RequestKey]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null]; nested exception is org.springframework.beans.factory.BeanExpressionEx ception: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy17'
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:281)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:125)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.applyPropertyValues(Abs tractAutowireCapableBeanFactory.java:1317)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.populateBean(AbstractAu towireCapableBeanFactory.java:1076)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:517)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.Abstract BeanFactory$1.getObject(AbstractBeanFactory.java:2 91)
at org.springframework.beans.factory.support.DefaultS ingletonBeanRegistry.getSingleton(DefaultSingleton BeanRegistry.java:222)
at org.springframework.beans.factory.support.Abstract BeanFactory.doGetBean(AbstractBeanFactory.java:288 )
at org.springframework.beans.factory.support.Abstract BeanFactory.getBean(AbstractBeanFactory.java:190)
at org.springframework.beans.factory.support.DefaultL istableBeanFactory.preInstantiateSingletons(Defaul tListableBeanFactory.java:563)
at org.springframework.context.support.AbstractApplic ationContext.finishBeanFactoryInitialization(Abstr actApplicationContext.java:872)
at org.springframework.context.support.AbstractApplic ationContext.refresh(AbstractApplicationContext.ja va:423)
at org.springframework.web.context.ContextLoader.crea teWebApplicationContext(ContextLoader.java:276)
at org.springframework.web.context.ContextLoader.init WebApplicationContext(ContextLoader.java:197)
at org.springframework.web.context.ContextLoaderListe ner.contextInitialized(ContextLoaderListener.java: 47)
at org.apache.catalina.core.StandardContext.listenerS tart(StandardContext.java:4790)
at org.apache.catalina.core.StandardContext.startInte rnal(StandardContext.java:5284)
at org.apache.catalina.util.LifecycleBase.start(Lifec ycleBase.java:150)
at org.apache.catalina.core.ContainerBase$StartChild. call(ContainerBase.java:1595)
at org.apache.catalina.core.ContainerBase$StartChild. call(ContainerBase.java:1585)
at java.util.concurrent.FutureTask$Sync.innerRun(Futu reTask.java:334)
at java.util.concurrent.FutureTask.run(FutureTask.jav a:166)
at java.util.concurrent.ThreadPoolExecutor.runWorker( ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:636)
Caused by: org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name '(inner bean)#5': Cannot create inner bean '(inner bean)' of type [org.springframework.security.access.SecurityConfig] while setting constructor argument with key [Root bean: class [org.springframework.security.web.access.intercept. RequestKey]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null]; nested exception is org.springframework.beans.factory.BeanExpressionEx ception: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy17'
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:281)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:125)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveManagedMap(BeanDefiniti onValueResolver.java:383)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:161)
at org.springframework.beans.factory.support.Construc torResolver.resolveConstructorArguments(Constructo rResolver.java:603)
at org.springframework.beans.factory.support.Construc torResolver.autowireConstructor(ConstructorResolve r.java:144)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.autowireConstructor(Abs tractAutowireCapableBeanFactory.java:993)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBeanInstance(Abst ractAutowireCapableBeanFactory.java:897)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:485)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:270)
... 25 more
Caused by: org.springframework.beans.factory.BeanExpressionEx ception: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy17'
at org.springframework.context.expression.StandardBea nExpressionResolver.evaluate(StandardBeanExpressio nResolver.java:140)
at org.springframework.beans.factory.support.Abstract BeanFactory.evaluateBeanDefinitionString(AbstractB eanFactory.java:1260)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.evaluate(BeanDefinitionValueRe solver.java:224)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:200)
at org.springframework.beans.factory.support.Construc torResolver.resolveConstructorArguments(Constructo rResolver.java:603)
at org.springframework.beans.factory.support.Construc torResolver.instantiateUsingFactoryMethod(Construc torResolver.java:429)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.instantiateUsingFactory Method(AbstractAutowireCapableBeanFactory.java:973 )
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBeanInstance(Abst ractAutowireCapableBeanFactory.java:879)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:485)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:270)
... 35 more
Caused by: org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy17'
at org.springframework.expression.spel.ast.PropertyOr FieldReference.readProperty(PropertyOrFieldReferen ce.java:206)
at org.springframework.expression.spel.ast.PropertyOr FieldReference.getValueInternal(PropertyOrFieldRef erence.java:71)
at org.springframework.expression.spel.ast.CompoundEx pression.getValueInternal(CompoundExpression.java: 57)
at org.springframework.expression.spel.ast.SpelNodeIm pl.getValue(SpelNodeImpl.java:93)
at org.springframework.expression.spel.standard.SpelE xpression.getValue(SpelExpression.java:88)
at org.springframework.context.expression.StandardBea nExpressionResolver.evaluate(StandardBeanExpressio nResolver.java:137)
... 45 more


Can you please give me an answer why this happens?I am using Spring 3.0.2

[objectamit]

The method should be named as getReturnStringMethod to use the expression as in

<intercept-url pattern="/messageDelete*" access="#{messageBoardService.returnStringMethod}" />

[mirnav]

I am still getting the same error.Can u please tel me what this error means and what cause it?

[mirnav]

I am stuck over this...Please give me a solution....

[mirnav]

Now i got a new exception

org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name 'org.springframework.security.web.access.intercept .FilterSecurityInterceptor#0': Cannot create inner bean '(inner bean)' of type [org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce] while setting bean property 'securityMetadataSource'; nested exception is org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name '(inner bean)#4': Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationExcepti on: Could not instantiate bean class [org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce]: Constructor threw exception; nested exception is java.lang.IllegalStateException: Cannot handle (123) '{'
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:281)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:125)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.applyPropertyValues(Abs tractAutowireCapableBeanFactory.java:1317)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.populateBean(AbstractAu towireCapableBeanFactory.java:1076)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:517)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.Abstract BeanFactory$1.getObject(AbstractBeanFactory.java:2 91)
at org.springframework.beans.factory.support.DefaultS ingletonBeanRegistry.getSingleton(DefaultSingleton BeanRegistry.java:222)
at org.springframework.beans.factory.support.Abstract BeanFactory.doGetBean(AbstractBeanFactory.java:288 )
at org.springframework.beans.factory.support.Abstract BeanFactory.getBean(AbstractBeanFactory.java:190)
at org.springframework.beans.factory.support.DefaultL istableBeanFactory.preInstantiateSingletons(Defaul tListableBeanFactory.java:563)
at org.springframework.context.support.AbstractApplic ationContext.finishBeanFactoryInitialization(Abstr actApplicationContext.java:872)
at org.springframework.context.support.AbstractApplic ationContext.refresh(AbstractApplicationContext.ja va:423)
at org.springframework.web.context.ContextLoader.crea teWebApplicationContext(ContextLoader.java:276)
at org.springframework.web.context.ContextLoader.init WebApplicationContext(ContextLoader.java:197)
at org.springframework.web.context.ContextLoaderListe ner.contextInitialized(ContextLoaderListener.java: 47)
at org.apache.catalina.core.StandardContext.listenerS tart(StandardContext.java:4790)
at org.apache.catalina.core.StandardContext.startInte rnal(StandardContext.java:5284)
at org.apache.catalina.util.LifecycleBase.start(Lifec ycleBase.java:150)
at org.apache.catalina.core.ContainerBase$StartChild. call(ContainerBase.java:1595)
at org.apache.catalina.core.ContainerBase$StartChild. call(ContainerBase.java:1585)
at java.util.concurrent.FutureTask$Sync.innerRun(Futu reTask.java:334)
at java.util.concurrent.FutureTask.run(FutureTask.jav a:166)
at java.util.concurrent.ThreadPoolExecutor.runWorker( ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:636)
Caused by: org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name '(inner bean)#4': Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationExcepti on: Could not instantiate bean class [org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce]: Constructor threw exception; nested exception is java.lang.IllegalStateException: Cannot handle (123) '{'
at org.springframework.beans.factory.support.Construc torResolver.autowireConstructor(ConstructorResolve r.java:285)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.autowireConstructor(Abs tractAutowireCapableBeanFactory.java:993)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBeanInstance(Abst ractAutowireCapableBeanFactory.java:897)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:485)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:270)
... 25 more
Caused by: org.springframework.beans.BeanInstantiationExcepti on: Could not instantiate bean class [org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce]: Constructor threw exception; nested exception is java.lang.IllegalStateException: Cannot handle (123) '{'
at org.springframework.beans.BeanUtils.instantiateCla ss(BeanUtils.java:141)
at org.springframework.beans.factory.support.SimpleIn stantiationStrategy.instantiate(SimpleInstantiatio nStrategy.java:107)
at org.springframework.beans.factory.support.Construc torResolver.autowireConstructor(ConstructorResolve r.java:277)
... 30 more
Caused by: java.lang.IllegalStateException: Cannot handle (123) '{'
at org.springframework.expression.spel.standard.Token izer.process(Tokenizer.java:181)
at org.springframework.expression.spel.standard.Token izer.<init>(Tokenizer.java:47)
at org.springframework.expression.spel.standard.Inter nalSpelExpressionParser.doParseExpression(Internal SpelExpressionParser.java:108)
at org.springframework.expression.spel.standard.SpelE xpressionParser.doParseExpression(SpelExpressionPa rser.java:56)
at org.springframework.expression.spel.standard.SpelE xpressionParser.doParseExpression(SpelExpressionPa rser.java:1)
at org.springframework.expression.common.TemplateAwar eExpressionParser.parseExpression(TemplateAwareExp ressionParser.java:66)
at org.springframework.expression.common.TemplateAwar eExpressionParser.parseExpression(TemplateAwareExp ressionParser.java:56)
at org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce.processMap(ExpressionBasedFilterInvocationSec urityMetadataSource.java:47)
at org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce.<init>(ExpressionBasedFilterInvocationSecurit yMetadataSource.java:29)
at sun.reflect.NativeConstructorAccessorImpl.newInsta nce0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInsta nce(NativeConstructorAccessorImpl.java:57)
at sun.reflect.DelegatingConstructorAccessorImpl.newI nstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Construc tor.java:532)
at org.springframework.beans.BeanUtils.instantiateCla ss(BeanUtils.java:126)
... 32 more

[mirnav]

I solved the issue.Thanks for the help.