Alex Rivera | Logout

Struts2 + Spring Security 2.06: Valuestack is null when attempting to use @Secured on an Action method

Asked 2012-01-12T02:19:16.813
38

Before I begin, I've to say the closest answer I've found is here but honestly I don't really understand what's going on there.

I'm using Struts2 + Spring Security 2.06 with a custom authentication provider and access decision manager to remove the need for a "ROLE_" prefix.

My applicationContext-security.xml looks like this:

    <beans:bean id="customAuthenticationProvider"
                class="com.test.testconsole.security.CustomAuthenticationProvider">
        <beans:property name="userManagementService" ref="userManagementService"/>
        <custom-authentication-provider/>
    </beans:bean>

    <!--Customize Spring Security's access decision manager to remove need for "ROLE_" prefix-->
    <beans:bean
            id="accessDecisionManager"
            class="org.springframework.security.vote.AffirmativeBased">
        <beans:property name="decisionVoters">
            <beans:list>
                <beans:ref bean="roleVoter"/>
                <beans:ref bean="authenticatedVoter"/>
            </beans:list>
        </beans:property>
    </beans:bean>

    <beans:bean
            id="roleVoter"
            class="org.springframework.security.vote.RoleVoter">
        <beans:property name="rolePrefix" value=""/>
    </beans:bean>

    <beans:bean
            id="authenticatedVoter"
            class="org.springframework.security.vote.AuthenticatedVoter">
    </beans:bean>

<global-method-security secured-annotations="enabled" access-decision-manager-ref="accessDecisionManager"/>

Relevant portion of my web.xml:

    <!--Spring Security-->
<filter
java spring struts2 spring-security spring-annotations
Edit
Report

1 Answer

1

I already did work with a project like this. I used Struts 2, Spring 3.0.0 and Spring Security.

I think you could try to annotate the struts actions with @org.springframework.stereotype.Controller ... this is the current way to Spring manage your Struts Action. I think it will fix the spring security issue you was related.

I remember another particularity about this architecture. In web.xml you must set the spring listeners and filters before the Struts 2 filters. I found my old project and my web.xml was like this:

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="starter" version="2.4" 
         xmlns="http://java.sun.com/xml/ns/j2ee" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

    <display-name>Onleague.com</display-name>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:META-INF/app-context.xml</param-value>
    </context-param>

    <!-- Spring -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>    
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>openSessionInViewFilter</filter-name>
        <filter-class>org.springframework.orm.hibernate3.support.OpenSessionInViewFilter</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>openSessionI
answered 2012-11-01T13:48:12.997

Your Answer