1

I'm attempting to integrate Spring's default access control list implementation into a Jersey contained Restful API. I successfully was able to implement Basic Authentication using the Spring Security Filter Chain and setting up an authentication manager in my securityContext.xml.

My problem in a nutshell is, after adding the acl-context.xml and making adjustments to other parts of the project, my project seems to not recognize the @pre and @post annotations. It doesn't throw an error, but it doesn't make queries to the database according to the mysql log. Is there something about the default implementation of Spring's ACL that relies on Spring MVC classes like @controller, @transactional, @resource, or @service?

Here is the repo with the code as it is now (I appologize for the extra classes laying about. It is a maven project. https://github.com/DataAnalyticsinStudentHands/RESTFUL-WS/tree/secure

web.xml:
https://github.com/DataAnalyticsinStudentHands/RESTFUL-WS/blob/secure/src/main/webapp/WEB-INF/web.xml

webSecurityConfig.xml:
https://github.com/DataAnalyticsinStudentHands/RESTFUL-WS/blob/secure/src/main/resources/webSecurityConfig.xml

acl-context.xml:
https://github.com/DataAnalyticsinStudentHands/RESTFUL-WS/blob/secure/src/main/resources/acl-context.xml

pom.xml:
https://github.com/DataAnalyticsinStudentHands/RESTFUL-WS/blob/secure/pom.xml

I'm sorry I would love to paste the .xmls here but I can't seem to get the formatting to work and its deleting characters. Please let me know if there is anything else I can do to clarify the situation. If I'm doing anything overtly stupid in regards to anything else, please let me know. I welcome the criticism. I'm the only person on our team working on network security and I don't have anyone here to give me feedback.

rahul pasricha
  • 931
  • 1
  • 14
  • 35
Tswiggs
  • 21
  • 6
  • You're confusing Spring MVC with the Spring IoC container. Spring Security doesn't need the first, but many of its features do rely on Spring IoC. – chrylis -cautiouslyoptimistic- Jul 07 '14 at 19:32
  • While that may be true, do you have any idea why I might be experiencing these problems? I used to activate(?) the acl configuration. I believe my issues probably do stem from a issue with the context. – Tswiggs Jul 07 '14 at 19:39
  • See [this answer](http://stackoverflow.com/questions/19896870/why-is-my-spring-autowired-field-null); it may explain some of your issue. – chrylis -cautiouslyoptimistic- Jul 07 '14 at 20:41
  • @chrylis So let me bounce what I got from that off you.. Because I do not have my service/object classes tracked by the spring context, Spring Security cannot look for annotations like `@Postauthorization` because it doesn't know they exist. Did that sound on track? I'm currently trying to make use of `@Autowired` to generate beans in the context. – Tswiggs Jul 07 '14 at 21:59
  • On the right track, and you're probably generating two bean instances. – chrylis -cautiouslyoptimistic- Jul 07 '14 at 22:44

0 Answers0