CODEWITHSUNDEEP
javaspringspring-mvcspring-securityspring-ws
Thomas Einwaller
Thomas Einwaller

Reputation: 9063

@Secured service methods and spring ws

I have the following project structure:

base project (service layer, model) web project webservice project

where both the web project and the web service project depend on the base project and use services provided by it.

I make heavy use of the Spring Framework which means the Services are Spring Beans with methods secured by the @Secured Annotation and Spring Security. I created an Voter extending the AbstractAclVoter that checks client permissions.

The web project uses Spring MVC and the web service project Spring WS with @Endpoint Annotations and the XwsSecurityInterceptor.

Here is my problem:

The permissions are checked if a call comes from a web project controller or in JUnit tests of the base project but requests from the web service project are not checked for the correct permission - my Voter is not called!

Upvotes: 0

Views: 1740

Answers (2)

Teja Kantamneni
Teja Kantamneni

Reputation: 17472

Your user authentication object with populated Granted Authority is available only in the web context not in your web services project. When you make a call to your web service application, you don't have the same security context over there. So your security tags won't work over there.

Upvotes: 1

Dónal Boyle
Dónal Boyle

Reputation: 3079

Spring Security integrates as a servlet filter in the web application. So I would assume that the DelegatingFilterProxy will need to be added to web.xml for the web services project so that it can process the requests going to that application.

Upvotes: 0

Related Questions