Hm, I guess that's not doing anything. Maybe giving you an example of what
I'm trying to do might help:
The following is my manager function I'm trying to secure:
@Secured({"ROLE_ADMIN"})
public void setGalleryCover(Long gid, Long pid);
and in my testcase I do the following:
@Test
public void testIllegalCalls() throws Exception{
// Just set an unauthorized user
SecurityContext context = new SecurityContextImpl();
User user = new User("user");
user.setId(1L);
user.setPassword("password");
user.addRole(new Role(Constants.USER_ROLE));
UsernamePasswordAuthenticationToken token =
new UsernamePasswordAuthenticationToken(user.getUsername(),
user.getPassword(), user.getAuthorities());
token.setDetails(user);
context.setAuthentication(token);
SecurityContextHolder.setContext(context);
// Do the call:
try{
galleryManager.setGalleryCover(1L, 1L);
throw new Exception("I could set the cover without being
authorized.");
}catch (SecurityException e) {
// TODO: handle exception
}
}
So I'd expect it to fail, but it runs through without so much as a hiccup.
Any ideas?
Mike Horwitz wrote:
>
> You may want to try commenting out the <protect-pointcut ...> elements.
> Annotations and AOP may not work together.
>
> Mike
>
> 2009/1/14 Christian Decker <[email protected]>
>
>>
>> Hm, still no luck with that. I changed the following to include
>> secured-annotations="enabled"
>>
>> <global-method-security secured-annotations="enabled">
>> <protect-pointcut expression="execution(*
>> *..service.UserManager.getUsers(..))" access="ROLE_ADMIN"/>
>> <protect-pointcut expression="execution(*
>> *..service.UserManager.removeUser(..))" access="ROLE_ADMIN"/>
>> <protect-pointcut expression="execution(*
>> *..service.UserManager.disableUser(..))" access="ROLE_ADMIN"/>
>> </global-method-security>
>>
>> But still no luck.
>>
>> Regards,
>> Chris
>>
>> Mike Horwitz wrote:
>> >
>> > You need to enable support for the @Secured aspect in the spring
>> security
>> > configuration. This is the section you need: http://tinyurl.com/7fc73s
>> >
>> > Mike
>> >
>> > 2009/1/14 Christian Decker <[email protected]>
>> >
>> >>
>> >> Hi all,
>> >>
>> >> I was looking for an easy and intuitive way to restrict access to
>> >> managers.
>> >> I found that Spring Security does support a @Secured annotation, but I
>> >> have
>> >> been unable to get it to work. Do I have to enable annotations for
>> this
>> >> kind
>> >> of thing? And if yes, where?
>> >>
>> >> regards,
>> >> Chris
>> >>
>> >> -----
>> >> Christian Decker
>> >> http://blog.snyke.net
>> >> --
>> >> View this message in context:
>> >>
>> http://www.nabble.com/Securing-managers-using-annotations-tp21448272s2369p21448272.html
>> >> Sent from the AppFuse - User mailing list archive at Nabble.com.
>> >>
>> >>
>> >> ---------------------------------------------------------------------
>> >> To unsubscribe, e-mail: [email protected]
>> >> For additional commands, e-mail: [email protected]
>> >>
>> >>
>> >
>> >
>>
>>
>> -----
>> Christian Decker
>> http://blog.snyke.net
>> --
>> View this message in context:
>> http://www.nabble.com/Securing-managers-using-annotations-tp21448272s2369p21465188.html
>> Sent from the AppFuse - User mailing list archive at Nabble.com.
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>>
>>
>
>
-----
Christian Decker
http://blog.snyke.net
--
View this message in context:
http://www.nabble.com/Securing-managers-using-annotations-tp21448272s2369p21465891.html
Sent from the AppFuse - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
