method @Secured suppose to throw error when no user authenticated yet

Question

my service look like below

@Controller
@GwtRpcEndPoint
public class ServerServiceImpl implements ServerService {

@org.springframework.security.annotation.Secured("ROLE_ADMIN")
public String runGwtSprMvcHibJpaDemo(String s) {

 System.out.println("SecurityContextHolder.getContext()="+SecurityContextHolder.getContext());
 System.out.println("SecurityContextHolder.getContext().getAuthentication()="+SecurityContextHolder.getContext().getAuthentication());
 }

}

my applicationContext.xml

<security:global-method-security secured-annotations="enabled" jsr250-annotations="disabled" />

but when i call the serviceImpl through gwt-rpc, aren't runGwtSprMvcHibJpaDemo suppose to print out security error since user not yet authenticated? Rather, the method runGwtSprMvcHibJpaDemo is executed with output

 SecurityContextHolder.getContext()=org.springframework.security.context.SecurityContextImpl@ffffffff: Null authentication  SecurityContextHolder.getContext().getAuthentication()=null

Answer 1

Add

<security:http auto-config="true">
        <security:intercept-url pattern="/**" access="ROLE_ADMIN" />
</security:http>

to your xml config and see if that fixes it.

Answer 2

i put like what you mentioned but get error ; by the way i trying to follow tutorial at http://seewah.blogspot.com/2009/02/gwt-and-spring-security.html in my service I annotated the method with @Secured("ROLE_ADMIN"); and in my xml, I put <security:global-method-security secured-annotations="enabled" jsr250-annotations="disabled" />

when app is startup is there any log message that i need aware of whether my method already successfully secured by spring?

org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_filterChainProxy': Initialization of bean failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_filterChainList': Cannot resolve reference to bean '_rememberMeFilter' while setting bean property 'filters' with key [6]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_rememberMeFilter': Cannot resolve reference to bean '_rememberMeServices' while setting bean property 'rememberMeServices'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_rememberMeServices': Initialization of bean failed; nested exception is org.springframework.security.config.SecurityConfigurationException: No UserDetailsService registered.

Answer 3

Define bean in your spring context like:

bean id="userDetailsService" class="packagename.MyUserService">.

Please note that bean name should be extactly same. Spring use this bean internally to start this service.

MyUserService is a implementation of UserDetailsService.