Question

I am using BlazeDS and Spring Security and have set up my application using a Spring Security filter chain and Dispatcher Servlet in my web.xml and in my application-context.xml I have set up the following…

<s:http 
    auto-config="true" 
    access-decision-manager-ref="accessDecisionManager"/>

<s:authentication-manager>
    <s:authentication-provider
        user-service-ref="userService"/>
</s:authentication-manager>

<f:message-broker>
    <f:secured/>
</f:message-broker>

<s:global-method-security 
    access-decision-manager-ref="accessDecisionManager">
    <s:protect-pointcut 
        expression="execution(* com.my.app.Server.*(..))" 
        access="ROLE_USER"/>
</s:global-method-security>

This generally works. The Spring message broker correctly allows me to access my java Server class and the ‘secured’ tag works and allows me to log into the channel set using my custom authentication manager (via userService). I can call remote methods on the Server class no problem.

However, I cannot get the global method security to work at all. I cannot get Spring to invoke my accessDecisionManager, or even to deny access to methods on the Server class, no matter which access role I use. Does anybody know how I can get this to work?

Incidentally, my Server class is not a Spring bean or anything like that, it is just a standard Java class as would be used in standard Flex remoting. Would this make a difference?

I’m using Spring Security 3 and Flex 4.5

Answer 1

Point cuts and aspects only works for Spring beans, if it is plain java object spring cannot intercept any method calls as it is not proxied. Please create a spring bean for your server class and it should be working fine.

Once you created the spring bean you can expose the bean through blaze DS using flex:remoting-destination