Java, Spring security and WebSecurityExpressionHandlers

[DaFoot]

I'm in the process of moving a Java (Spring MVC/Hibernate) project from Ant to Maven build and dependency management. While I'm doing that I'm trying to bring the libraries up to date.

 

So moving from Spring 3.0.5 to 3.1.1.

 

My project will now build and deploy, but as soon as I hit a JSP that uses authorisation taglib (eg <sec:authorize access="isAuthenticated()">) I get a useful error message:

 

javax.servlet.ServletException: javax.servlet.jsp.JspException: java.io.IOException: No visible WebSecurityExpressionHandler instance could be found in the application context. There must be at least one in order to support expressions in JSP 'authorize' tags.

 

So the framework wants an instance of WebSecurityExpressionHandler, fine.

 

In my old project Spring seemed quite happy with the following in the security-context:

<beans:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler" />
<http auto-config="true" use-expressions="true" .....

 

but now I'm getting that error about the WebSecurityExpressionHandler not existing in the app context. I think I've got all the same jars as old project (albeit newer versions) so that leads me to believe WebSecurityExpressionHandler has moved or is no longer in Spring security.

 

Indeed a bit of reading around the web and I came across a reference in Spring's Jira that suggested just that, but no suggestion how I should handle it's absence.

 

Can anyone here offer any pointers?

[RabM]

Sorry no, have you tried stackexchange?

[DaFoot]

I've been posting on Stack Exchange, no luck there.

 

I was in the process of moving to Spring-security 3.1.1 rather than 3.0 and trying to use spring-security-3.1.xsd in my namespace declarations. That was giving me an error directing me to to use 3.0.3.xsd instead which is when I was getting this error.

 

I finally got 3.1.1.xsd accepted after reorganising my jar dependencies in Maven and moving my code into a new Eclipse project. The error above went away when I finally got 3.1.xsd working.

[RabM]

One of my colleagues has swapped from Rational Team Concert to STS for java/spring development and he raves about the difference. Works much better at all the Spring dependency management stuff and has nice tools for spring transformers in particular. I'm still getting my head around spring.