Spring App error: java.lang.NoClassDefFoundError: org/springframework/security/core/SpringSecurityCoreVersion

Question

I am writing a simple spring mvc login form example. I am getting below error in netbeans

  05-Jun-2014 02:11:51.055 SEVERE [http-nio-8084-exec-1] org.apache.catalina.core.StandardContext.listenerStart Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener
  org.springframework.beans.factory.BeanDefinitionStoreException: Unexpected exception parsing XML document from ServletContext resource [/WEB-INF/SpringSecurity.xml]; nested exception is org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [org.springframework.security.config.SecurityNamespaceHandler]: Constructor threw exception; nested exception is java.lang.NoClassDefFoundError: org/springframework/security/core/SpringSecurityCoreVersion
  at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:413)
  at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:335)
  at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:303)
  at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:180)
  at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:216)
  at org.springframework.beans.factory.support.AbstractBeanDefinitionReader.loadBeanDefinitions(AbstractBeanDefinitionReader.java:187)
  at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:125)
  at org.springframework.web.context.support.XmlWebApplicationContext.loadBeanDefinitions(XmlWebApplicationContext.java:94)
  at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:129)
  at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:540)
  at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:454)
  at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
  at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
  at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
  at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
  at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5158)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
  at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:726)
  at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:702)
  at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:697)
  at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:579)
  at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:455)
  at org.apache.catalina.startup.HostConfig.check(HostConfig.java:1554)
  at sun.reflect.GeneratedMethodAccessor53.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:300)
  at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
  at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
  at org.apache.catalina.manager.ManagerServlet.check(ManagerServlet.java:1428)
  at org.apache.catalina.manager.ManagerServlet.deploy(ManagerServlet.java:885)
  at org.apache.catalina.manager.ManagerServlet.doGet(ManagerServlet.java:343)
  at javax.servlet.http.HttpServlet.service(HttpServlet.java:618)
  at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:301)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.netbeans.modules.web.monitor.server.MonitorFilter.doFilter(MonitorFilter.java:393)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:108)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
  at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:615)
  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:136)
  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:74)
  at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610)
  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:516)
  at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1015)
  at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:652)
  at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222)
  at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1575)
  at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1533)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
  at java.lang.Thread.run(Thread.java:744)
Caused by: org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [org.springframework.security.config.SecurityNamespaceHandler]: Constructor threw exception; nested exception is java.lang.NoClassDefFoundError: org/springframework/security/core/SpringSecurityCoreVersion
  at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:164)
  at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:105)
  at org.springframework.beans.factory.xml.DefaultNamespaceHandlerResolver.resolve(DefaultNamespaceHandlerResolver.java:130)
  at org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseCustomElement(BeanDefinitionParserDelegate.java:1419)
  at org.springframework.beans.factory.xml.BeanDefinitionParserDelegate.parseCustomElement(BeanDefinitionParserDelegate.java:1414)
  at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.parseBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:187)
  at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.doRegisterBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:141)
  at org.springframework.beans.factory.xml.DefaultBeanDefinitionDocumentReader.registerBeanDefinitions(DefaultBeanDefinitionDocumentReader.java:110)
  at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.registerBeanDefinitions(XmlBeanDefinitionReader.java:508)
  at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:391)
  ... 60 more
Caused by: java.lang.NoClassDefFoundError: org/springframework/security/core/SpringSecurityCoreVersion
  at org.springframework.security.config.SecurityNamespaceHandler.<init>(SecurityNamespaceHandler.java:65)
  at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
  at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
  at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
  at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
  at org.springframework.beans.BeanUtils.instantiateClass(BeanUtils.java:148)
  ... 69 more
Caused by: java.lang.ClassNotFoundException: org.springframework.security.core.SpringSecurityCoreVersion
  at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1284)
  at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1132)
  ... 75 more

I am using spring 3.2.7. It was not having spring security jar. So I got it downloaded using maven. It's version is 3.2.4. What is this error? There's no error in code. What must have gone wrong? For last 3 hours I have been trying to run a simple example, but totally hammered by this error. Please help

Answer 1

Here's an example of a Spring MVC controller that handles login without Spring Security:

@Controller
@SuppressWarnings("SpringJavaAutowiringInspection")
public class LoginController {
    private static final Logger log = LoggerFactory.getLogger(LoginController.class);
    @Autowired private UserService userService;

    /**
     * Both display the login form and handle the form submission.
     */
    @RequestMapping("/in.app")
    public String login(String account, String password, ModelMap model, 
                        HttpSession session) throws Exception {
        if (account == null) {
            log.debug("Displaying login form");
            return "login/login";
        }
        log.debug("Processing login for user {}", account);
        User user = userService.login(account, password);
        if (user == null) {
            model.put("error", "The supplied account or password is incorrect");
            model.put("account", account);
            return "login/login";
        }
        //Create the user and session
        session.setAttribute("user", user);
        return "forward:/frame.app";
    }

    /**
     * Logout and invalidate the session.
     */
    @RequestMapping("/out.app")
    public String logout(HttpSession session) throws Exception {
        session.invalidate();
        return "login/login";
    }

And a Filter to guard the URL's for no session:

/**
 * Check that a session exists and redirect to the login page if it doesn't.
 */
@WebFilter(filterName = "SessionFilter", urlPatterns = { "*.app" })
public class SessionFilter implements Filter {
    private static final Logger log = LoggerFactory.getLogger(SessionFilter.class);
    private static final int AUTHENTICATION_TIMEOUT = 419;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        log.debug("Initializing session filter");
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain filterChain) throws IOException, ServletException {
        String path = ((HttpServletRequest) request).getServletPath();
        HttpSession session = ((HttpServletRequest) request).getSession(false);
        if ((session != null && session.getAttribute("user") != null) 
             || path.endsWith("in.app")) {
            filterChain.doFilter(request, response);
        }
        else {
            log.debug("Session has expired requesting url");
            ((HttpServletResponse) response).sendError(AUTHENTICATION_TIMEOUT);
        }
    }

    @Override
    public void destroy() {
    }

}

Answer 2

org.springframework.security.core.SpringSecurityCoreVersion can be found in this version:

spring-security-core-3.2.4.RELEASE.jar

You can add the dependency on your maven pom to let maven download it and build into your web project.

Answer 3

You don't have:

org.springframework.security.core.SpringSecurityCoreVersion

available in your class path at run time.

It's Spring that's complaining about this when it tries to bring up your context (not the compiler at compile time, i.e. this is a configuration issue, not a "code error").

Spring Security is packaged in two jars:

• spring-security-config-3.2.0.RELEASE.jar
• spring-security-core-3.2.0.RELEASE.jar

You must be missing the "core" jar...