Really strange thing just happened: while trying to demonstrate the functionality of an ajax call it didn't work (as usual in demonstrations), only later I found out that the call return 403 access denied, which is the expected behaviour, so my guess is that secured-annotations="enabled" actually did the trick, with the exception of unit tests, which still go through without a hitch when they should throw an exception. So my guess now is that my setup of the IoC container (which includes security handler, right?) is somehow messed up. What should I do to have the security annotations considered in unit tests too?
Regards, Chris Christian Decker wrote: > > Hm, still no luck with that. I changed the following to include > secured-annotations="enabled" > > <global-method-security secured-annotations="enabled"> > <protect-pointcut expression="execution(* > *..service.UserManager.getUsers(..))" access="ROLE_ADMIN"/> > <protect-pointcut expression="execution(* > *..service.UserManager.removeUser(..))" access="ROLE_ADMIN"/> > <protect-pointcut expression="execution(* > *..service.UserManager.disableUser(..))" access="ROLE_ADMIN"/> > </global-method-security> > > But still no luck. > > Regards, > Chris > > Mike Horwitz wrote: >> >> You need to enable support for the @Secured aspect in the spring security >> configuration. This is the section you need: http://tinyurl.com/7fc73s >> >> Mike >> >> 2009/1/14 Christian Decker <[email protected]> >> >>> >>> Hi all, >>> >>> I was looking for an easy and intuitive way to restrict access to >>> managers. >>> I found that Spring Security does support a @Secured annotation, but I >>> have >>> been unable to get it to work. Do I have to enable annotations for this >>> kind >>> of thing? And if yes, where? >>> >>> regards, >>> Chris >>> >>> ----- >>> Christian Decker >>> http://blog.snyke.net >>> -- >>> View this message in context: >>> http://www.nabble.com/Securing-managers-using-annotations-tp21448272s2369p21448272.html >>> Sent from the AppFuse - User mailing list archive at Nabble.com. >>> >>> >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >>> >> >> > > ----- Christian Decker http://blog.snyke.net -- View this message in context: http://www.nabble.com/Securing-managers-using-annotations-tp21448272s2369p21491020.html Sent from the AppFuse - User mailing list archive at Nabble.com. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
