Security interceptors with a custom service

[acis]

Hi everybody,

I'm defining a new service to manage document lifecycle. Everything is working perfectly until I want to manage security on the methods of my custom service class.

I defined :
- a custom aspect : adding some custom properties to a node
- a lifecycle service : managing the custom properties of the node
- an action executer : adding the new aspect to a node and initializing the properties
- a ressource bundle : displaying custom messages

Here is my configuration context file :

<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'> <beans>       <bean id="extension.dictionaryBootstrap" parent="dictionaryModelBootstrap" depends-on="dictionaryBootstrap">        <property name="models">            <list>                <value>alfresco/extension/lifecycle-model.xml</value>            </list>        </property>    </bean>        <bean id="lifeCycleService" class="org.alfresco.sample.LifeCycle.LifeCycleServiceImpl">       <property name="nodeService">            <ref bean="nodeService" />       </property>    </bean>        <bean id="LifeCycleService" class="org.springframework.aop.framework.ProxyFactoryBean">        <property name="proxyInterfaces">            <list>                <value>org.alfresco.sample.LifeCycle.LifeCycleService</value>            </list>        </property>        <property name="target">            <ref bean="lifeCycleService"/>        </property>         <property name="interceptorNames">            <list>            <idref local="LifeCycleService_transaction"/>            <idref local="LifeCycleService_security"/>            </list>        </property>     </bean>        <bean id="LifeCycleService_transaction" class="org.springframework.transaction.interceptor.TransactionInterceptor">        <property name="transactionManager">            <ref bean="transactionManager"/>        </property>        <property name="transactionAttributes">            <props>                <prop key="get*">${server.transaction.mode.readOnly}</prop>                <prop key="*">${server.transaction.mode.default}</prop>            </props>        </property>    </bean>        <bean id="LifeCycleService_security" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">        <property name="authenticationManager"><ref bean="authenticationManager"/></property>        <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property>        <property name="afterInvocationManager"><ref bean="afterInvocationManager"/></property>        <property name="objectDefinitionSource">            <value>               org.alfresco.sample.LifeCycle.LifeCycleService.nextState=ACL_NODE.0.sys:base.WriteProperties               org.alfresco.sample.LifeCycle.LifeCycleService.previousState=ACL_NODE.0.sys:base.WriteProperties               org.alfresco.sample.LifeCycle.LifeCycleService.exception=ACL_NODE.0.sys:base.WriteProperties               org.alfresco.sample.LifeCycle.LifeCycleService.init=ACL_NODE.0.sys:base.WriteProperties            </value>        </property>    </bean>        <bean id="addlifecycle" class="org.alfresco.sample.LifeCycle.LifeCycleActionExecuter" parent="action-executer">      <property name="lifeCycleService">         <ref bean="lifeCycleService" />      </property>   </bean>      <bean id="lifecycle-msg" class="org.alfresco.i18n.ResourceBundleBootstrapComponent">      <property name="resourceBundles">         <list>            <value>org.alfresco.sample.LifeCycle.lifecycle-msg</value>         </list>      </property>   </bean>          </beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I also defined a custom action to add the custom aspect to a node. This custom action is displaying a list of available lifecycles. I used the add-features.jsp as a base for my add-lifecycle.jsp.

In my custom config, when there is no section about LifeCycleService_security, everything is working fine. But if I had this section, the OK button on the JSP is not working anymore. The following error is displayed :

javax.faces.el.EvaluationException: Cannot get value for expression '#{NavigationBean.isGuest == false && NavigationBean.guestHomeVisible}'
caused by:
javax.servlet.jsp.el.ELException: An error occurred while getting property "guestHomeVisible" from an instance of class org.alfresco.web.bean.NavigationBean

I don't understand why there is a relation between the security interceptors and the NavigationBean. Someone can help me ?

Thanks

[acis]

I found the solution

To avoid this problem, it's mandatory to define security on each method. Use ACL_ALLOW for the methods with no security requirements.

I still don't understand why the NavigationBean is linked to security interceptors but at least my code works fine.