A very simple silly question....Must be a bean before @PreAuthorize to work?

[Jeryl Cook]

Hi,
Do I have to have my class initialized via an applicationContext in order for @PreAuthorize(...) to work>??? I can get access to the authenticated Principle by doing a ServletContextHolder.getContext()..... but can't get my method security to work.....because the bean is that i am using is not wired up in the applicationContext....

[Marten Deinum]

Yes... Only beans in the spring context will be secured...

You can however use AspectJ with loadtime or compile time weaving to apply security but this requires your setup to change.

[objectamit]

If you use configurable annotation on the corresponding object, then you can even if you create the instance with a new operator and don't initialize from within spring config at all.