I run an OSGI application on Karaf 4.0.4.
This application is not a web application.
I configured Apache Shiro in order to login using a custom SecurityRealm that use the credentials stored in an SQL database. The SecurityManagerand the realm are configured using Blueprint
This part works fine.
I want to use annotations like:
#RequiresPermissions("doSomething")
#RequiresRoles("admin")
public void myMethodToDoSomething() {
...
}
Those annoations are never evaluated. (my security realm protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) method is never called.
After reading some Shiro documentation, I understand it doesn't work because I don't have the required interceptor as it's defined in the Shiro Spring turorial:
<!-- Enable Shiro Annotations for Spring-configured beans. Only run after -->
<!-- the lifecycleBeanProcessor has run: -->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
But as I'm not using spring in my application, those lines won't work.
You can create a blueprint namespace module. This can then hook into the blueprint beans to install an interceptor. As an example see the blueprint-authz module.
Related
My project framework is designed in such a way that I don't have access to Springs ApplicationContext. However, I would like to inject beans based on a system property. If the property is set to true, then inject all the beans, else inject none. Is this a possibility. Something like the below. BTW, Spring version is 3.0
<!-- all beans -->
<bean></bean>
<bean></bean>
<bean></bean>
<bean class ="org.springframework...PropertyPlaceHolderConfigurer>
<property name = "properties"
<value>
OBJECT_INSTANCE_ID =0
</value>
</property>
<bean>
In short the property is read using PropertyPlaceHolderConfigurer. All other beans should load based on value OBJECT_INSTANCE_ID. The property is defined in a property file located at /etc/../system.property
You can use Spring profiles to achieve this functionality:
<beans profile="dev">
<bean id="devConfig" class="<yourClassName>" />
</beans>
In the above example, the devConfig bean will be constructed only if dev profile is activated. You can activate a profile as follows:
Using annotations:
#ActiveProfiles("dev")
Using system property:
-Dspring.profiles.active=dev
If you would go for modern approaches like Java configs and Spring Boot, you can use #ConditionalOnProperty annotation that Spring Boot introduced as one of the conditional injections.
I am using ehcache in my project so when server start data of few table will be loaded into the cache ..in my application i am using Spring,Hibernate,JSF
I m using this configurationin applicationCOntext.xml file
<bean id="cacheManager" class="com.ccc.service.cache.CacheManager" init-method="init">
<property name="delay" value="${timer.delay}" />
</bean>
<bean id="companyCache" class="com.ccc.service.cache.clients.ValidCacheClient"/>
<context:component-scan base-package="com.ccc.spring" />
<context:annotation-config />
<context:spring-configured />
In Jsf Managed Bean i am creating Object of Service class like this
#ManagedProperty(value = "#{GlobalDataService}")
static GlobalDataService globalDataService;
But in ValidCacheClient.java how to create object of Service class? ValidCacheClient.java is not a manged class so how to create the Object of Service class?
You have two options:
Inject the necessary beans to be known from JSF as ServletContext attributes, so these beans will be treat by JSF as application scoped attributes. You can do this using Spring ServletContextAttributeExporter:
<bean class="org.springframework.web.context.support.ServletContextAttributeExporter">
<property name="attributes">
<map>
<entry key="globalDataService" value-ref="GlobalDataService" />
</map>
</property>
</bean>
Then you can inject it without problems in JSF:
#ManagedProperty(value = "#{globalDataService}")
GlobalDataService globalDataService; //no need to be static
Let Spring container manage the lyfecycle of JSF managed beans. With this approach, you may inject the springs beans using #Autowired. This is covered in Spring 3 + JSF 2 tutorials. Still, note that if you do this, you will lose access to JSF 2 view scope (crucial when working with ajax requests in the same view) because Spring still cannot support it. But this can be solved by creating a custom implementation for view scope, like Cagatay's
IMO I would use the latter approach rather than the former.
More info:
Set attributes of ServletContext in Spring 3.2 MVC configuration
Mkyong tutorial to integrate Spring 3 and JSF 2.0
Bean properties are shared across different sessions
Integration jsf, spring, hibernate. How to inject Spring beans into JSF managed beans?
I've updated my spring security to 3.2 to be able to use Java based annotations to configure the project, without need to have an XML.
I almost configure all things, but there is 2 issues I didn't (and don't know how) to configure.
How can I configure the Http403ForbiddenEntryPoint?
How can I configure my custom AuthenticationManager?
<security:http entry-point-ref="entryPoint" >
...
</security:http>
<bean id="entryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />
<security:authentication-manager alias="myAuthenticationManagerImpl" />
Here is my custom authentication class:
#Service ("authenticationManager")
public class AuthenticationManagerImpl implements AuthenticationManager {
...
}
Apparently there is something in the works to address this but as it currently stands there is no way of doing this through annotations. This question seems to seeking the same answer. The standalone project in the works is here and apparently they are merging it into spring security 3.2.X sometime in the near future.
How to exclude beans, or packages from Spring AOP processing scope?
I encountered this, while fixing Spring Integration JMX support issue on JBoss.
As a development environment, we are using Spring 3.2.0.RELEASE, Spring Integration 2.2.0.RELEASE and Jboss AS 7.1.1.
When enabling Spring Integration JMX, you are actually creating IntegrationMBeanExporter, which extracts all Spring Integration related beans from the underlying ApplicationContext and creates appropriate managed MBeans. For assigning created MBeans to server MBeanServer required, which must be defined in ApplicationContext, which is generally done using standard MBeanServerFactoryBean, which returns platform related MBeanServer.
The problem appeared, because we were using Spring AOP for some enhanced operations, and AOP post processing mechanism was trying to process platform mbeanServer like regular bean, validating initial platform ClassLoader against internal pointcuts, which it eventually failed to do.
This seems to be similar to https://jira.springsource.org/browse/SPR-9335, but with generic specifics.
So as a solution, I prevented spring from processing mbeanServer as a part ApplicationContext :
<bean id="jmxIntegration" scope="singleton" class="org.springframework.integration.monitor.IntegrationMBeanExporter">
<property name="server" value="#{ T(org.springframework.jmx.support.JmxUtils).locateMBeanServer() }"/>
</bean>
This worked, but this seems to be of a more generic problem, with AOP.
Also interesting note is that MBeanExporter in spring also refers to JmxUtils instead of context's MBeanServer.
I'm writing web application that uses Spring MVC to bind Spring beans with REST-like channels.
I've created the configuration basic both on my previous apps (pure XML configuration) and example, which used <mvc:annotation-driven/> feature. I'm pointing a package with controllers with <context:component-scan base-package="my.package"/> in spring xml file.
It is working - in Spring 3.0.6.RELEASE. However, after upgrading to 3.1.0.RELEASE my controllers stopped to be detected and no channel was registered. Spring context contains no implementation of HelloChannel interface.
Is this a bug in this Spring version, or I'm using deprecated configuration, which stopped to be supported in newer version? I got no error or warning, simply no bean is auto-detected.
The controller interface definition looks like that:
#RequestMapping("/config") public interface ConfigChannel
And the implementation:
#Controller
public class ConfigChannelImpl implements ConfigChannel
The Spring documentation indicates that interface-based #Controllers are for proxying transactional methods. As such, you are probably using the <tx:annotation-driven /> tag. The problem you now seem to have is that Spring 3.1 introduced support for CGLIB, a runtime-based bytecode manipulator. You need to add proxy-target-class="true" to your transaction configuration and add CGLIB to your classpath.
<tx:annotation-driven proxy-target-class="true" />
From http://static.springsource.org/spring/docs/3.1.0.M1/spring-framework-reference/html/mvc.html#mvc-ann-requestmapping