Question

I’m using JDBC backed SpringSecurity ACLs to manage my user-created objects.

I have a @Service, which deals with the CRUD of my ACL-protected objects, and so needs to generate appropriate ACLs and store them. I’ve marked the entire class as @Transactional, configured in my spring-security.xml as

<bean id="oauthTXManager" 
    class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
    <property name="dataSource" ref="dataSource"/>
</bean>

<tx:annotation-driven transaction-manager="oauthTXManager" />

That dataSource is working (promise!), it’s a Postgres DB, if that could be important.

So back to the @Service. It looks like this (in part):

@Autowired
@Qualifier("aclService")
private MutableAclService aclService;

...

public Store createNewProfileWithOwner(Store profile, User owner) {
    try {
        Connection con = dataSource.getConnection();
        PreparedStatement query = con.prepareStatement(PROFILE_INSERT);
        ...
        query.executeUpdate();

        Sid sid = new PrincipalSid(owner.getUsername());
        Permission p = BasePermission.ADMINISTRATION;
        ObjectIdentity oi = new ObjectIdentityImpl(profile);
        MutableAcl acl = null;
        try {
            acl = (MutableAcl) aclService.readAclById(oi);
        } catch (NotFoundException e) {
            acl = aclService.createAcl(oi);
        }
        acl.setOwner(sid);
        acl.insertAce(acl.getEntries().size(), p, sid, true);
        aclService.updateAcl(acl);
        profile.setOwner(owner.getUsername());
        ...

    } catch (SQLException e) {
        e.printStackTrace();
    }
    return profile;
}

I have a wee script, which tests the API that calls this method. Approximately half of the times I run the script, I get an error at acl = aclService.createAcl(oi), where having created the ACL SpringSecurity tries to read it back but can’t find it. Much like the problem described in this forum. The other 50% of the time it works just fine. The best I could narrow it down more than “randomly, about half the time”, was that if I ran the script, and it didn’t work, and then ran it again more than four seconds but less than twenty seconds later, it would work.

Weirdly, when I check the DB, the id that SpringSecurity claims it can’t find in the DB is definitely there.

I’m assuming that I’m running up against some kind of Transaction or caching issue. I read Section 10.5.6 of Transaction Management but I’m afraid it didn’t really help me pinpoint where the error might be.

Any and all advice welcome.

Answer 1

I “fixed” it by making all the methods synchronized and also tipped off by SpringSecurity @Secured and @PreAuthorized I forced @PreAuthrorized to be evaluated before @Transactional.

So far, it works.