Problems with MethodSecurityInterceptor and java annotations

[olve]

I have some problems regarding the use of java annotations for acegi (from http://up-u.com/?p=183) and MethodSecurityInterceptor together with TransactionProxyFactoryBean.

The problem is as follows; if I have
interface BaseManager{}
class BaseManagerImpl implements BaseManager{}
interface UserManager implements BaseManager {}
class UserManagerImpl extends BaseManagerImpl implements UserManager {}

UserManagerImpl is managed by spring as a proxied bean using TransactionProxyFactoryBean.

Only the Class objects for BaseManager and BaseManagerImpl is presented to the AcegiAnnotationAttributes class.
I have only one manager in my project which is not proxied by a TransactionProxyFactoryBean, and it is the only manager with a Class object proposed to my AcegiAnnotationAttributes implementation correctly. All other are proposed as explained.

Where does this problem lie? Is it a fault in MethodDefinitionAttributes as it doesn't handle that the declaring class of the intercepted method is a proxy, or do I have to set up this case in a special way?

It looks like AbstractMethodDefinitionSource.java:51 does the check if the object in question is a MethodInvocation before checking if it is a JoinPoint. If a call to a TransactionFactoryBean is a JoinPoint, then this is a bug, as an object can both be a MethodInvocation, and a JoinPoint. While the code in AMDS:51 does not take this into acount.

Hope someone can shed some light on this one, it has been bugging me for some time now.

Btw; I use acegi 0.8.2, and springframework 1.2-rc2 (the 1.2 release has not yet propagated to the maven repos).

Regards,
Olve S. Hansen

[olve]

It looks like AbstractMethodDefinitionSource.java:51 does the check if the object in question is a MethodInvocation before checking if it is a JoinPoint. If a call to a TransactionFactoryBean is a JoinPoint, then this is a bug, as an object can both be a MethodInvocation, and a JoinPoint. While the code in AMDS:51 does not take this into acount.

I see now that this (the quote above) has nothing to do with my problems, a JoinPoint is aspectj, while a MethodInvocation is aopalliance. In my case I certainly don't use both, and i any case wouldn't use both on the same method.

Anyway, I still have problem with retrieving attributes from proxied classes.

Regards
Olve S. Hansen

[Ben Alex]

I'm sorry Olve, I am not familiar with the AcegiAnnotationAttributes. Have you tried contacting its author?

[olve]

Problem solved.

Sorry for being a bit unclear... I was trying to use the Attributes interface to do method based security interception. It works well in a test case, but in our real application it dind't.

The real problem didn't have anything to do the AcegiAnnotationAttributes, as it merely extends the Attributes interface, and retrieves annotations for the Class objects presented to it.

The problem was that the bean with the methods I wanted to intercept was a part of a transaction proxy. And the Class object presented to the Attributes implementation was not of the implementation (e.g. UserManagerImpl) type but of one of the super types (e.g. BaseManager and BaseManagerImpl).

I have now switched to the DefaultAutoProxy in spring for handling transactions and security annotations both in jsr-175 style. My guess is that the MethodDefinitionSourceAdvisor cannot make a pointcut on an already proxied class.

Sorry for the lack of clear language in terms of AOP, I am not too familiar with that vocabulary yet.

Anyway, thanks for making this superb framework.

---
Olve