无法将 String 类型的值转换为 MethodSecurityMetadataSource (Spring 3.1)

Question

从 Spring 3.0.0 升级到 3.1.0 之后 我无法实例化 MethodSecurityInterceptor bean。 这是在 Spring 3.0.0 中工作的原始 bean 定义：

<bean id="methodSecurityInterceptor" class="org.springframework.security.access.interce pt.aopalliance.MethodSecurityInterceptor">
  <property name="authenticationManager" ref="myAuthenticationManager" />
  <property name="accessDecisionManager" ref="myAccessDecisionManager" />
  <property name="securityMetadataSource">
  <value>
     com.myPackage.foo=ROLE_ADMIN
     com.myPackage.bar=ROLE_ADMIN
     com.myPackage.inner.*=ROLE_ADMIN
  </value>
</bean>

抛出此异常：

exception is org.springframework.beans.ConversionNotSupportedEx ception: Failed to 
convert property value of type 'java.lang.String' to required type 
'org.springframework.security.access.method.Method SecurityMetadataSource' for property 'securityMetadataSource'; nested exception is java.lang.IllegalStateException: Cannot convert value of type [java.lang.String] to required type [org.springframework.security.access.method.MethodS ecurityMetadataSource] for property 'securityMetadataSource': no matching editors or conversion strategy found
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:527)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.createBean(AbstractAuto wireCapableBeanFactory.java:456)
at org.springframework.beans.factory.support.Abstract BeanFactory$1.getObject(AbstractBeanFactory.java:2 93)
at org.springframework.beans.factory.support.DefaultS ingletonBeanRegistry.getSingleton(DefaultSingleton BeanRegistry.java:222)
at org.springframework.beans.factory.support.Abstract BeanFactory.doGetBean(AbstractBeanFactory.java:290 )
at org.springframework.beans.factory.support.Abstract BeanFactory.getBean(AbstractBeanFactory.java:196)
at org.springframework.aop.support.AbstractBeanFactor yPointcutAdvisor.getAdvice(AbstractBeanFactoryPoin tcutAdvisor.java:80)
at org.springframework.aop.aspectj.AspectJProxyUtils. isAspectJAdvice(AspectJProxyUtils.java:67)
at org.springframework.aop.aspectj.AspectJProxyUtils. makeAdvisorChainAspectJCapableIfNecessary(AspectJP roxyUtils.java:49)
at org.springframework.aop.aspectj.autoproxy.AspectJA wareAdvisorAutoProxyCreator.extendAdvisors(AspectJ AwareAdvisorAutoProxyCreator.java:101)
at org.springframework.aop.framework.autoproxy.Abstra ctAdvisorAutoProxyCreator.findEligibleAdvisors(Abs tractAdvisorAutoProxyCreator.java:88)
at org.springframework.aop.framework.autoproxy.Abstra ctAdvisorAutoProxyCreator.getAdvicesAndAdvisorsFor Bean(AbstractAdvisorAutoProxyCreator.java:68)
at org.springframework.aop.framework.autoproxy.Abstra ctAutoProxyCreator.wrapIfNecessary(AbstractAutoPro xyCreator.java:359)
at org.springframework.aop.framework.autoproxy.Abstra ctAutoProxyCreator.postProcessAfterInitialization( AbstractAutoProxyCreator.java:322)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.applyBeanPostProcessors AfterInitialization(AbstractAutowireCapableBeanFac tory.java:407)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.initializeBean(Abstract AutowireCapableBeanFactory.java:1426)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:519)
... 24 more
Caused by: org.springframework.beans.ConversionNotSupportedEx ception: Failed to convert property value of type 'java.lang.String' to required type 'org.springframework.security.access.method.Method SecurityMetadataSource' for property 'securityMetadataSource'; nested exception is java.lang.IllegalStateException: Cannot convert value of type [java.lang.String] to required type [org.springframework.security.access.method.MethodS ecurityMetadataSource] for property 'securityMetadataSource': no matching editors or conversion strategy found
at org.springframework.beans.BeanWrapperImpl.convertI fNecessary(BeanWrapperImpl.java:481)
at org.springframework.beans.BeanWrapperImpl.convertF orProperty(BeanWrapperImpl.java:518)
at org.springframework.beans.BeanWrapperImpl.convertF orProperty(BeanWrapperImpl.java:512)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.convertForProperty(Abst ractAutowireCapableBeanFactory.java:1371)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.applyPropertyValues(Abs tractAutowireCapableBeanFactory.java:1330)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.populateBean(AbstractAu towireCapableBeanFactory.java:1086)
at org.springframework.beans.factory.support.Abstract AutowireCapableBeanFactory.doCreateBean(AbstractAu towireCapableBeanFactory.java:517)
... 40 more
Caused by: java.lang.IllegalStateException: Cannot convert value of type [java.lang.String] to required type [org.springframework.security.access.method.MethodS ecurityMetadataSource] for property 'securityMetadataSource': no matching editors or conversion strategy found
at org.springframework.beans.TypeConverterDelegate.co nvertIfNecessary(TypeConverterDelegate.java:233)
at org.springframework.beans.BeanWrapperImpl.convertI fNecessary(BeanWrapperImpl.java:466)
... 46 more

任何帮助将不胜感激。

Answer 1

负责将 securityMetadataSource value 中出现的字符串转换为 MethodSecurityMetadataSource 实例的类 - MethodSecurityMetadataSourceEditor 在 Spring 3.1 中被删除，这就是你得到异常的原因。

在 3.1 中添加了一个新类：MethodSecurityMetadataSourceBeanDefinitionParser。它在您的 XML 文件中为您提供了一个新标签。
所以，而不是：

  <value>
     com.myPackage.foo=ROLE_ADMIN
     com.myPackage.bar=ROLE_ADMIN
     com.myPackage.inner.*=ROLE_ADMIN
  </value>

你现在可以写了：

 <s:method-security-metadata-source> 
    <s:protect method="com.myPackage.foo" access="ROLE_ADMIN"/>
    <s:protect method="com.myPackage.bar" access="ROLE_ADMIN"/>
    <s:protect method="com.myPackage.inner.*" access="ROLE_ADMIN"/>
 </s:method-security-metadata-source>

附： 不要忘记将 xml 架构更新到 3.1：

xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">