SEC-2301: GlobalMethodSecurityConfiguration's DefaultWebSecurityExpressionHandler has null BeanResolver

[spring-projects-issues]

Rob Winch (Migrated from SEC-2301) said:

this blog post got me started with java config, and everything worked fine until i tried to use @PreAuthorize annotation that uses my custom authentication service (via @myCustomService) expression. I get an error that

No bean resolver registered in the context to resolve access to bean myCustomService

Looking at M2 and RC1 source code, it seems that when WebSecurity is created in WebSecurityConfiguration and the default DefaultWebSecurityExpressionHandler is used and it has no BeanResolver set (from AbstractSecurityExpressionHandler).

Might this be a bug in the java based configuration?

[spring-projects-issues]

Rob Winch said:

A workaround is to set the expression handler manually. This can be done with something like:

@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    @Autowired
    private ApplicationContext context;

    @Override
    protected MethodSecurityExpressionHandler expressionHandler() {
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
        handler.setApplicationContext(context);
        return handler;
    }

    // ... other config ...
}