spring-projects / spring-projects/spring-security
property permissionEvaluator of DefaultMethodSecurityExpressionHandler is always DenyAllPermissionEvaluator in child application context
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
spring-security version 4.1.3.RELEASE
I have root application context and I created a new child context while initializing root context.
Root context has configuration bean GlobalMethodSecurityConfiguration:
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfiguration extends GlobalMethodSecurityConfiguration
{
...
@Bean
public MutableAclService aclService()
...
}
@Bean
public PermissionEvaluator permissionEvaluator(AclService aclService)
{
return new AclPermissionEvaluator(aclService);
}
...
}
while root context initializing created a new child context
migrationContext = new AnnotationConfigApplicationContext();
migrationContext.setParent(applicationContext);
in child context created beans which call some protected methods with PreAuthorize("hasPermission(...)") annotation
but I always get AccessDeniedException
because root context is in initializing method GlobalMethodSecurityConfiguration.afterSingletonsInstantiated is not called yet
and expression evaluator uses default permission evaluator DenyAllPermissionEvaluator but expected to be used AclPermissionEvaluator.
Before changes in afterSingletonsInstantiated method GlobalMethodSecurityConfiguration configures defaultMethodExpressionHandler correct autowired permission evaluator (AclPermissionEvaluator).
How to correct configure GlobalMethodSecurityConfiguration before child context will be create?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace GlobalMethodSecurityConfiguration.afterSingletonsInstantiated and the DefaultMethodSecurityExpressionHandler setup, then compare that lifecycle with creation of the child AnnotationConfigApplicationContext. Verify when the permission evaluator is selected and confirm that the child-context calls using PreAuthorize("hasPermission(...)") use the configured AclPermissionEvaluator rather than DenyAllPermissionEvaluator.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100