Announcement Announcement Module
Collapse
No announcement yet.
CGLIB for only one class, not all? Page Title Module
Move Remove Collapse
This topic is closed
X
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • CGLIB for only one class, not all?

    Hi everybody,

    I currently migrating a few smaller applications to spring security 2.0.4, and run into following problem on a web project:

    When trying to introduce the fancy namespace tags to make spring care about the @RolesAllowed (formely used @Secure) attributes, I seem to have 2 choices:
    Either have <aop:config> with proxy-target-class true or false.

    Both are undesireble to me, is there a way to make only one bean be proxied with CGLIB? The only way I have found out until now is to configure the interceptor the old (acegi) way:
    Code:
     <bean id="objectMethodSecurity" class="org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor" autowire="byType">
            <property name="accessDecisionManager" ref="accessMethodDecisionManager"/>
            <property name="objectDefinitionSource" ref="objectDefinitionSourceMethods"/>
        </bean>
    	
    	
    
        <bean id="objectDefinitionSourceMethods" class="org.springframework.security.annotation.Jsr250MethodDefinitionSource" />
       
       <bean id="accessMethodDecisionManager"
    		class="org.springframework.security.vote.AffirmativeBased">
    		<property name="decisionVoters">
    			<list>
    				<bean class="org.springframework.security.vote.RoleVoter">
    					<property name="rolePrefix" value="ROLE_" />
    				</bean>
    			</list>
    		</property>
    	</bean>
    	
    	<bean id="autoProxyCreator"
    		class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator">
    		<property name="interceptorNames">
    			<list>
    				<value>objectMethodSecurity</value>
    			</list>
    		</property>
    		<property name="beanNames">
    			<list>
    				<value>myClassToBeProxiedWithCGLIB</value>
    			</list>
    		</property>
    		<property name="proxyTargetClass" value="true" />
    	</bean>
    Like this it works, but I would rather use the
    Code:
     <security:global-method-security jsr250-annotations="enabled" secured-annotations="enabled"/>
    tag if somehow possible. But then I would have to somehow specify that only this myClassToBeProxiedWithCGLIB bean should get CGLIB proxies, the others not. (Because the whole thing is also working together with seam).

    Regards and a nice day

    Danny
Working...
X