Circular reference trying to configure custom permission evaluator in spring security

Question

I'm trying to configure a custom permission evaluator but whenever the app starts up it's complaining of a circular reference.

The configuration code is:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    private static Logger logger = LogManager.getLogger(MethodSecurityConfig.class.getName());

    @Autowired
    DataSource dataSource;

    @Autowired
    Environment env;

    @Autowired
    AuthenticationManager auth;

    public MethodSecurityConfig() {
        logger.debug("Loading method security config.");
    }


    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return auth;
    }

    /**
     * Override to set up the custom expression handler.
     * @return The custom expression handler
     */
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return expressionHandler();
    }

    /**
     * Defines a custom permission evaluator to evaluate the access permissions for Spring security.
     * @return The default expression handler configured with a custom permission evaluator.
     */
    @Bean
    public DefaultMethodSecurityExpressionHandler expressionHandler(){
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
        handler.setPermissionEvaluator(permissionEvaluator());
        return handler;
    }

    /**
     * Custom implementation of a permission evaluator
     * @return An instance of {@link BasePermissionEvaluator}
     */
    @Bean
    public PermissionEvaluator permissionEvaluator() {
       return new BasePermissionEvaluator();
    }

}

When the app start up this exception occurs:

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'methodSecurityConfig': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.setPermissionEvaluator(java.util.List); nested exception is org.springframework.beans.factory.BeanCurrentlyInCreationException: Error creating bean with name 'permissionEvaluator': Requested bean is currently in creation: Is there an unresolvable circular reference?
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334) ~[AutowiredAnnotationBeanPostProcessor.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1214) ~[AbstractAutowireCapableBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:543) ~[AbstractAutowireCapableBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482) ~[AbstractAutowireCapableBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:305) ~[AbstractBeanFactory$1.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230) ~[DefaultSingletonBeanRegistry.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:301) ~[AbstractBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:196) ~[AbstractBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:368) ~[ConstructorResolver.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(A

What am I doing wrong here? I tried various things like adding the AuthenticationManager. Is there something else I need to override?

score 0 · Answer 1 · edited May 23 '17 at 11:59

I had faced the same issue. In my case the reason was there was another security configuration class which has @EnableGlobalMethodSecurity annotation. Removing that annotation solved the issue.

The reason to have two security configuration classes is described here.

To my understanding this happens when Spring first processes the other configuration class, because of @EnableGlobalMethodSecurity permissionEvaluator and similar beans are registered that time and later when this configuration class is processed we got this error.

Also looks like this behaviour is arbitrary, depends on which configuration class is first processed based on classpath ordering.

Circular reference trying to configure custom permission evaluator in spring security

1 Answers1