Question

I have multiple http blocks in my spring security configuration. This is allowed since Spring Security version 3.1. The problem occurs when my SpringSocial config attempts to auto inject a RequestCache object. I get the following error: No qualifying bean of type [org.springframework.security.web.savedrequest.RequestCache] is defined: expected single matching bean but found 3. If I remove the reference in Java code to the auto wired RequestCache object, having three http blocks in my xml configuration is ok. What is the best approach to fix this error? Is there some way to autowire the correct RequestCache?

The xml http blocks:

<http pattern="/oauth/token"...>
</http>

<http pattern="/something/**...>
</http>

<http use-expressions="true"...>
</http>

In Java Config, there is a reference to an autowired RequestCache:

@Bean
public ProviderSignInController providerSignInController(RequestCache requestCache) {
    return new ProviderSignInController(connectionFactoryLocator(), usersConnectionRepository(), new SimpleSignInAdapter(requestCache, userService));
} 

Neither of these cause a problem by themselves. However, having multiple http blocks and an autowired RequestCache causes: “No qualifying bean of type [org.springframework.security.web.savedrequest.RequestCache] is defined: expected single matching bean but found 3”

Can anyone help me with a way to configure this correctly?

Answer 1

The issue is that each block creates its own instance of RequestCache. Using a new instance, will still work between the blocks since the default implementation of RequestCache uses the same data store (i.e. the HttpSession). However, when you try to use autowiring it does not know which instance to use. Instead, you create your own instance of HttpSessionRequestCache and use it (just as the http blocks do). For example:

@Bean
public ProviderSignInController providerSignInController() {
    RequestCache requestCache = new HttpSessionRequestCache();  
    return new ProviderSignInController(connectionFactoryLocator(), usersConnectionRepository(), new SimpleSignInAdapter(requestCache, userService));
}

An alternative that should work is to specify the RequestCache in configuration and reuse the same instance using the request-cache element. For example:

<bean:bean class="org.springframework.security.web.savedrequest.HttpSessionRequestCache"
        id="requestCache" />

<http pattern="/oauth/token"...>
    <request-cache ref="requestCache"/>
</http>

<http pattern="/something/**...>
    <request-cache ref="requestCache"/>
</http>

<http use-expressions="true"...>
    <request-cache ref="requestCache"/>
</http>

Since there is a single RequestCache instance, you can use your existing Java Config (i.e. autowire the RequestCache). Note that you could just as easily create the RequestCache in Java Config instead of in XML if you desire.