IllegalArgumentException on Tomcat startup

[Kiran Keshav]

Hello,

When adding an acl voter to my decisionVoters in the accessDecisionManager, I always get a

java.lang.IllegalArgumentException: AccessDecisionManager does not support secure object class: class net.sf.acegisecurity.intercept.web.FilterInvocation
	at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:246)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1003)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:348)
	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:226)
	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:147)

In my applicationContext-security.xml file I have:

<bean id="securityEnforcementFilter" class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter">
        <property name="filterSecurityInterceptor"><ref local="filterInvocationInterceptor"/></property>
        <property name="authenticationEntryPoint"><ref local="authenticationProcessingFilterEntryPoint"/></property>
    </bean>
    
    <bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager"><ref local="authenticationManager"/></property>
        <property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property>
        <property name="objectDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /signup.html=admin,user
                /passwordhint.html*=admin,user
                /**/*.html*=admin,user
                /**/*.htm*=admin,user
                /clickstreams.jsp=admin
            </value>
        </property>
    </bean>
    <bean id="businessAccessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
      <property name="allowIfAllAbstainDecisions"><value>false</value></property>
      <property name="decisionVoters">
         <list>
            <ref local="roleVoter"/>
            <ref local="aclMyObjectWriteVoter"/>          
         </list>
      </property>  
   </bean>

As a recent adopter of Acegi, this is probably a configuration issue. Any ideas? I am currently using version 0.8.3.

Thanks in advance.

[Kiran Keshav]

There was a reference in my filterInvocationInterceptor to an accessDecisionManager with an aclVoter. When using both the filterInvocationInterceptor and the methodInvocationInterceptor, you have to define 2 different accessDecisionManagers, one with acl voters (called by the methodInvocationIterceptor) and one without (called by the filterInvocationInterceptor).

[Ben Alex]

This is correct. BasicAclEntryVoter will only support MethodInvocation security - not FilterInvocation security. As such, at startup time the FilterSecurityInterceptor (which uses FilterInvocation) queried the corresponding AccessDecisionManager and found a non-supporting AccessDecisionVoter.

I thought I'd expand on what was happening to help other users who encounter this.