spring-projects / spring-projects/spring-security

property permissionEvaluator of DefaultMethodSecurityExpressionHandler is always DenyAllPermissionEvaluator in child application context

Open
#4,059 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

spring-security version 4.1.3.RELEASE

I have root application context and I created a new child context while initializing root context.
Root context has configuration bean GlobalMethodSecurityConfiguration:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfiguration extends GlobalMethodSecurityConfiguration
{
... 
    @Bean
    public MutableAclService aclService()
...
    }

    @Bean
    public PermissionEvaluator permissionEvaluator(AclService aclService)
    {
        return new AclPermissionEvaluator(aclService);
    }
...
}

while root context initializing created a new child context

migrationContext = new AnnotationConfigApplicationContext();

            migrationContext.setParent(applicationContext);

in child context created beans which call some protected methods with PreAuthorize("hasPermission(...)") annotation
but I always get AccessDeniedException
because root context is in initializing method GlobalMethodSecurityConfiguration.afterSingletonsInstantiated is not called yet
and expression evaluator uses default permission evaluator DenyAllPermissionEvaluator but expected to be used AclPermissionEvaluator.

Before changes in afterSingletonsInstantiated method GlobalMethodSecurityConfiguration configures defaultMethodExpressionHandler correct autowired permission evaluator (AclPermissionEvaluator).

How to correct configure GlobalMethodSecurityConfiguration before child context will be create?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Trace GlobalMethodSecurityConfiguration.afterSingletonsInstantiated and the DefaultMethodSecurityExpressionHandler setup, then compare that lifecycle with creation of the child AnnotationConfigApplicationContext. Verify when the permission evaluator is selected and confirm that the child-context calls using PreAuthorize("hasPermission(...)") use the configured AclPermissionEvaluator rather than DenyAllPermissionEvaluator.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.