Spring Security
  1. Spring Security
  2. SEC-906

SecuredMethodDefinitionSource always requires AspectJ to be on the classpath

    Details

    • Type: Improvement Improvement
    • Status: Closed
    • Priority: Minor Minor
    • Resolution: Won't Fix
    • Affects Version/s: 2.0.3
    • Fix Version/s: 3.0.0 M1
    • Component/s: None
    • Labels:
      None
    • Environment:
      Spring 2.5, Spring Security 2.0.3, Java 6

      Description

      When setting up a SecuredMethodDefinitionSource based on AOP Alliance Java will throw a "java.lang.NoClassDefFoundError: org/aspectj/lang/Signature ". The reason is that SecuredMethodDefinitionSource extends AbstractFallbackMethodDefinitionSource which has compile time references to AOP alliance and aspectJ classes. Thus it currently is not possible to use @Secured without having AspectJ on the classpath.

      AbstractFallbackMethodDefinitionSource as well as AbstractMethodDefinitionSource should delegate AspectJ related checkings to subclasses that are only loaded if it is dynamically determined whether AspectJ is on the classpath or not.

      Right now I helped myself by patching the class and simply commenting out all JoinPoint and Signature class references.

        Issue Links

          Activity

          Hide
          Luke Taylor added a comment -

          This dependency has been in there since Acegi's AspectJSecurityInterceptor was written so this isn't anything new and so a decision can be postponed till 2.1. Any changes to check with classloaders etc will just make the code harder to follow and the aspectj runtime jar is only about 100k in size in any case.

          Show
          Luke Taylor added a comment - This dependency has been in there since Acegi's AspectJSecurityInterceptor was written so this isn't anything new and so a decision can be postponed till 2.1. Any changes to check with classloaders etc will just make the code harder to follow and the aspectj runtime jar is only about 100k in size in any case.
          Hide
          Luke Taylor added a comment -

          I don't think this justifies making changes to core code to locate classes reflectively etc. It just makes for a maintenance headache and aspectj is likely to feature even more strongly in future releases.

          Show
          Luke Taylor added a comment - I don't think this justifies making changes to core code to locate classes reflectively etc. It just makes for a maintenance headache and aspectj is likely to feature even more strongly in future releases.
          Hide
          Dan Diephouse added a comment -

          This dependency wasn't in Acegi 1.0.6. We performed a straightforward upgrade of our app and this is the first time we had to add the dependency.

          Show
          Dan Diephouse added a comment - This dependency wasn't in Acegi 1.0.6. We performed a straightforward upgrade of our app and this is the first time we had to add the dependency.

            People

            • Assignee:
              Luke Taylor
              Reporter:
              Johan
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: