Exception while using SpEL in intercept url.

[mirnav]

I have the intercept url as shown below:

<intercept-url pattern="/messageDelete*" access="hasRole('${messageBoardService.returnStrin gMethod}')" />

And implementation of returnStringMethod is like below:

public String getReturnStringMethod()
{
return "ROLE_ADMIN";
}

If I am hardcoding like access="hasRole('ROLE_ADMIN')" it will work.But the above implementation is not working.Can you please tel me why it happens.

[objectamit]

The Spel uses #{} for expression evaluation and not ${}. Please make a note of that

[mirnav]

when i am using #{} instead of ${} i am getting the following exception.Thats why i used ${}.

org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name 'org.springframework.security.web.access.intercept .FilterSecurityInterceptor#0': Cannot create inner bean '(inner bean)' of type [org.springframework.security.web.access.expression .ExpressionBasedFilterInvocationSecurityMetadataSo urce] while setting bean property 'securityMetadataSource'; nested exception is org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name '(inner bean)#5': Cannot create inner bean '(inner bean)' of type [org.springframework.security.access.SecurityConfig] while setting constructor argument with key [Root bean: class [org.springframework.security.web.access.intercept. RequestKey]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null]; nested exception is org.springframework.beans.factory.BeanExpressionEx ception: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy18'
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:281)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:125)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.applyPropertyValues(Abs tractAutowireCapableBeanFactory.java:1317)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.populateBean(AbstractAu towireCapableBeanFactory.java:1076)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:517)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.Abstract BeanFactory$1.getObject(AbstractBeanFactory.java:2 91)
at org.springframework.beans.factory.support.DefaultS ingletonBeanRegistry.getSingleton(DefaultSingleton BeanRegistry.java:222)
at org.springframework.beans.factory.support.Abstract BeanFactory.doGetBean(AbstractBeanFactory.java:288 )
at org.springframework.beans.factory.support.Abstract BeanFactory.getBean(AbstractBeanFactory.java:190)
at org.springframework.beans.factory.support.DefaultL istableBeanFactory.preInstantiateSingletons(Defaul tListableBeanFactory.java:563)
at org.springframework.context.support.AbstractApplic ationContext.finishBeanFactoryInitialization(Abstr actApplicationContext.java:872)
at org.springframework.context.support.AbstractApplic ationContext.refresh(AbstractApplicationContext.ja va:423)
at org.springframework.web.context.ContextLoader.crea teWebApplicationContext(ContextLoader.java:276)
at org.springframework.web.context.ContextLoader.init WebApplicationContext(ContextLoader.java:197)
at org.springframework.web.context.ContextLoaderListe ner.contextInitialized(ContextLoaderListener.java: 47)
at org.apache.catalina.core.StandardContext.listenerS tart(StandardContext.java:4790)
at org.apache.catalina.core.StandardContext.startInte rnal(StandardContext.java:5284)
at org.apache.catalina.util.LifecycleBase.start(Lifec ycleBase.java:150)
at org.apache.catalina.core.ContainerBase$StartChild. call(ContainerBase.java:1595)
at org.apache.catalina.core.ContainerBase$StartChild. call(ContainerBase.java:1585)
at java.util.concurrent.FutureTask$Sync.innerRun(Futu reTask.java:334)
at java.util.concurrent.FutureTask.run(FutureTask.jav a:166)
at java.util.concurrent.ThreadPoolExecutor.runWorker( ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:636)
Caused by: org.springframework.beans.factory.BeanCreationExce ption: Error creating bean with name '(inner bean)#5': Cannot create inner bean '(inner bean)' of type [org.springframework.security.access.SecurityConfig] while setting constructor argument with key [Root bean: class [org.springframework.security.web.access.intercept. RequestKey]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null]; nested exception is org.springframework.beans.factory.BeanExpressionEx ception: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy18'
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:281)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:125)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveManagedMap(BeanDefiniti onValueResolver.java:383)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:161)
at org.springframework.beans.factory.support.Construc torResolver.resolveConstructorArguments(Constructo rResolver.java:603)
at org.springframework.beans.factory.support.Construc torResolver.autowireConstructor(ConstructorResolve r.java:144)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.autowireConstructor(Abs tractAutowireCapableBeanFactory.java:993)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBeanInstance(Abst ractAutowireCapableBeanFactory.java:897)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:485)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:270)
... 25 more
Caused by: org.springframework.beans.factory.BeanExpressionEx ception: Expression parsing failed; nested exception is org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy18'
at org.springframework.context.expression.StandardBea nExpressionResolver.evaluate(StandardBeanExpressio nResolver.java:140)
at org.springframework.beans.factory.support.Abstract BeanFactory.evaluateBeanDefinitionString(AbstractB eanFactory.java:1260)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.evaluate(BeanDefinitionValueRe solver.java:224)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveValueIfNecessary(BeanDe finitionValueResolver.java:200)
at org.springframework.beans.factory.support.Construc torResolver.resolveConstructorArguments(Constructo rResolver.java:603)
at org.springframework.beans.factory.support.Construc torResolver.instantiateUsingFactoryMethod(Construc torResolver.java:429)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.instantiateUsingFactory Method(AbstractAutowireCapableBeanFactory.java:973 )
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBeanInstance(Abst ractAutowireCapableBeanFactory.java:879)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:485)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.BeanDefi nitionValueResolver.resolveInnerBean(BeanDefinitio nValueResolver.java:270)
... 35 more
Caused by: org.springframework.expression.spel.SpelEvaluation Exception: EL1008Epos 20): Field or property 'returnStringMethod' cannot be found on object of type '$Proxy18'
at org.springframework.expression.spel.ast.PropertyOr FieldReference.readProperty(PropertyOrFieldReferen ce.java:206)
at org.springframework.expression.spel.ast.PropertyOr FieldReference.getValueInternal(PropertyOrFieldRef erence.java:71)
at org.springframework.expression.spel.ast.CompoundEx pression.getValueInternal(CompoundExpression.java: 57)
at org.springframework.expression.spel.ast.SpelNodeIm pl.getTypedValue(SpelNodeImpl.java:102)
at org.springframework.expression.spel.standard.SpelE xpression.getValue(SpelExpression.java:97)
at org.springframework.expression.common.CompositeStr ingExpression.getValue(CompositeStringExpression.j ava:82)
at org.springframework.expression.common.CompositeStr ingExpression.getValue(CompositeStringExpression.j ava:1)
at org.springframework.context.expression.StandardBea nExpressionResolver.evaluate(StandardBeanExpressio nResolver.java:137)
... 45 more

[mirnav]

Now the navigation is not working even if the ROLE_ADMIN is logged.

[objectamit]

use this

<intercept-url pattern="/messageDelete*" access="hasRole('#{@messageBoardService.returnStri ngMethod}')" />

For details look here

[mirnav]

I have made changes as u told but still the issue persists.Can u please help me...I am stuck over here for the last two days...

[mirnav]

use this
For details look here

If I am hardcoding the access attribute,the page will navigate.But if I am attempting for access="hasRole('#{@messageBoardService.returnStri ngMethod}')" ,it will not navigate.Please give me a solution for this.

[objectamit]

Can you upload a simple standalone project skeleton for me to take a look at?

[mirnav]

My applicationContext-security.xml looks like this:


<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schem...-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">


<http auto-config="true" use-expressions="true">
<intercept-url pattern="/login.jsp*" access="permitAll"/>
<intercept-url pattern="/messageList*" access="hasRole('ROLE_USER')" />
<intercept-url pattern="/messagePost*" access="hasRole('ROLE_USER')" />
<intercept-url pattern="/messageDelete*" access="hasRole('${@messageBoardService.returnStri ngMethod}')"/>
<form-login login-page="/login.jsp" default-target-url="/messageList" authentication-failure-url="/login.jsp?error=true" />
<logout logout-success-url="/login.jsp" />
<session-management invalid-session-url="/login.jsp" />
<access-denied-handler error-page="/accessDenied.jsp"/>
</http>


<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.Af firmativeBased">
<beansroperty name="decisionVoters">
<beans:list>
<beans:bean class="org.springframework.security.access.vote.Ro leVoter" />
<beans:bean class="org.springframework.security.access.vote.Au thenticatedVoter" />
<!-- <beans:bean class="com.apress.springrecipes.board.security.IpA ddressVoter" /> -->
</beans:list>
</beansroperty>
</beans:bean>


<authentication-manager>
<authentication-provider user-service-ref="userDetailsService"/>
</authentication-manager>

<beans:bean id = "userDetailsService" class = "org.assyst.learning.springSecurity.bean.MyUserSer vice" />

<beans:bean id="test" class="org.assyst.learning.springSecurity.bean.con troller"></beans:bean>
</beans:beans>

Method in my MessageBoardServiceImpl class looks like this:
public String getReturnStringMethod()
{
ExpressionParser parser = new SpelExpressionParser();
Expression exp = parser.parseExpression("'ROLE_ADMIN'");
String message = (String) exp.getValue();
System.out.println("MESSAGE:>>>"+message);
return message;
}

[objectamit]

use this

<intercept-url pattern="/messageDelete*" access="hasRole('#{@messageBoardService.getReturnS tringMethod}')"/>

should work for sure