Unable to validate role in Spring Security for url pattern

spring spring-mvc spring-security spelevaluationexception
tarunkumar picture tarunkumar · Feb 11, 2015 · Viewed 24k times · Source

I am using spring security 3.1.7.RELEASE with spring 3.2.13.RELEASE.

I have entry in my spring-security.xml as follows:

<http auto-config="true" use-expressions="true"> 
    <intercept-url pattern=".*admin.htm" access="hasRole(ROLE_ADMIN)" />
    <intercept-url pattern="/siteadmin/*.htm" access="ROLE_ADMIN" />
    <intercept-url pattern="/siteadmin/cleancache.htm" access="hasRole('ROLE_ADMIN')" />

When I try to hit url /siteadmin/cleancache.htm I get following exception:

java.lang.IllegalArgumentException: Failed to evaluate expression 'ROLE_ADMIN' org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:13) org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:34) org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:18) org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)

Root Cause:

org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Property or field 'ROLE_ADMIN' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot' - maybe not public? org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:214) org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:85) org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:78) org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:102) org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:98) org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11) org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:34)

Any pointers on same are highly appreciated.

Answer

thedoctor picture thedoctor · Feb 11, 2015

You have a couple of typos. The first intercept-url line is missing single quotes around ROLE_ADMIN and the second line is missing hasRole. It should be

<http auto-config="true" use-expressions="true"> 
    <intercept-url pattern=".*admin.htm" access="hasRole('ROLE_ADMIN')" />
    <intercept-url pattern="/siteadmin/*.htm" access="hasRole('ROLE_ADMIN')" />
    <intercept-url pattern="/siteadmin/cleancache.htm" access="hasRole('ROLE_ADMIN')" />

Related questions

How to fix Hibernate LazyInitializationException: failed to lazily initialize a collection of roles, could not initialize proxy - no Session

In the custom AuthenticationProvider from my spring project, I am trying read the list of authorities of the logged user, but I am facing the following error: org.hibernate.LazyInitializationException: failed to lazily initialize a collection of role: com.horariolivre.…

Read More
How do I get the Session Object in Spring?

I am relatively new to Spring and Spring security. I was attempting to write a program where I needed to authenticate a user at the server end using Spring security, I came up with the following: public class CustomAuthenticationProvider extends …

Read More
When using Spring Security, what is the proper way to obtain current username (i.e. SecurityContext) information in a bean?

I have a Spring MVC web app which uses Spring Security. I want to know the username of the currently logged in user. I'm using the code snippet given below . Is this the accepted way? I don't like having a …

Read More