@PreAuthorize does not work - Is there an unsolvable circular link?

Question

I am trying spring security example (user role authorization) using @PreAuthorize annotation, stuck with error below.

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.aopalliance.intercept.MethodInterceptor]: Factory method 'methodSecurityInterceptor' threw exception; nested exception is org.springframework.beans.factory.BeanCurrentlyInCreationException: Error creating bean with name 'methodSecurityInterceptor': Requested bean is currently in creation: Is there an unresolvable circular reference? at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189) at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588) ... 91 more Caused by: org.springframework.beans.factory.BeanCurrentlyInCreationException: Error creating bean with name 'methodSecurityInterceptor': Requested bean is currently in creation: I s there an unresolvable circular reference? at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.beforeSingletonCreation(DefaultSingletonBeanRegistry.java:347) at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223) at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299) at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199) at org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor.getAdvice(MethodSecurityMetadataSourceAdvisor.java:107) at org.springframework.aop.aspectj.AspectJProxyUtils.isAspectJAdvice(AspectJProxyUtils.java:67) at org.springframework.aop.aspectj.AspectJProxyUtils.makeAdvisorChainAspectJCapableIfNecessary(AspectJProxyUtils.java:49) 

My WebSecurityConfigurerAdapter class:

 @Configuration @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) @EnableGlobalMethodSecurity(prePostEnabled = true) public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().anyRequest().authenticated().and() .formLogin().loginPage("/login").defaultSuccessUrl("/home") .permitAll().and().logout().permitAll() .logoutRequestMatcher(new AntPathRequestMatcher("/logout")) .logoutSuccessUrl("/login?logout").permitAll() .and().httpBasic() .and().exceptionHandling() .accessDeniedPage("/access?error"); } 

And check the authorization of the method level in the UserController:

  @Controller @EnableAutoConfiguration public class UserController { @PreAuthorize("hasAnyAuthority('111')") @RequestMapping(value = "/users") public String userManagement(Model model) { . return something; } } 

I get user privileges (list) during login at which there are 111

Can someone help me with a face-to-face error?

Answer 1

I recently had a similar problem.
My project had @PreAuthorize profiles @PreAuthorize well as aspects that handle audit logic.
In my case, this was enough:
1. Update the security configuration as follows.

 @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(mode = ASPECTJ, prePostEnabled = true, securedEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter` 

2.add dependency in pom.xml

 <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-aspects</artifactId> <version>4.1.0.RELEASE</version> </dependency> 

Hope someone finds this helpful.

Answer 2

Do not use a static modifier for the WebSecurityConfigurerAdapter.

Try the following snippet:

 @Configuration @EnableWebSecurity @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) @EnableGlobalMethodSecurity(securedEnabled = true, proxyTargetClass = true, prePostEnabled = true) public class SecurityConfiguration extends WebSecurityConfigurerAdapter { // do your stuff here 

The @EnableAutoConfiguration anomaly should not be around your controller, but around your application.