Java: Spring security 3 Jerarquía de roles

Question

Estoy utilizando Spring framework mvc 3 + seguridad de primavera 3. Me gustaría habilitar la jerarquía de funciones en mi seguridad de primavera. Según http://static.springsource.org/spring-security/site/docs/3.1.x/reference/authz-arch.html que debería escribir

<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter"> 
    <constructor-arg ref="roleHierarchy" /> 
</bean> 
<bean id="roleHierarchy" 
    class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"> 
<property name="hierarchy"> 
    ROLE_ADMIN > ROLE_STAFF 
    ROLE_STAFF > ROLE_USER 
    ROLE_USER > ROLE_GUEST 
</property> 
</bean> 

Pero, ¿dónde lo pongo? Traté de ponerlo en mi aplicación security.xml-:

<beans:beans xmlns="http://www.springframework.org/schema/security" 
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 
    <http> 
     <intercept-url pattern="/entryPost/**" access="ROLE_USER" requires-channel="https"/> 
     <intercept-url pattern="/entryDelete/**" access="ROLE_ADMIN" requires-channel="https"/> 
     <intercept-url pattern="/commentDelete/**" access="ROLE_ADMIN" requires-channel="https"/> 
     <intercept-url pattern="/login" access="ROLE_ANONYMOUS" requires-channel="https"/> 
     <form-login login-page="/login" default-target-url="/entryList/1" authentication-failure-url="/login?error=true" /> 
     <logout logout-success-url="/login" /> 
     <session-management> 
      <concurrency-control max-sessions="1" /> 
     </session-management> 
     <access-denied-handler error-page="/accessDenied"/> 
    </http> 
    <authentication-manager> 
     <authentication-provider> 
      <jdbc-user-service data-source-ref="dataSource" 
      users-by-username-query="SELECT username,password,'true' as enabled FROM member WHERE username=?" 
      authorities-by-username-query="SELECT member.username,role FROM member,memberRole WHERE member.username=? AND member.id=memberRole.member_id"/> 
     </authentication-provider> 
    </authentication-manager> 
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter"> 
    <constructor-arg ref="roleHierarchy" /> 
</bean> 
<bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"> 
    <property name="hierarchy"> 
     ROLE_ADMIN > ROLE_STAFF 
     ROLE_STAFF > ROLE_USER 
     ROLE_USER > ROLE_GUEST 
    </property> 
</bean> 

Pero no funciona: HTTP Status 404

Cuando lo puse en App-servlet.xml:

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:mvc="http://www.springframework.org/schema/mvc" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:context="http://www.springframework.org/schema/context" 
xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/context 
    http://www.springframework.org/schema/context/spring-context-3.0.xsd 
    http://www.springframework.org/schema/mvc 
    http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd"> 
    <context:component-scan base-package="rus.web"/> 
    <bean id="entryValidator" class="rus.domain.EntryValidator"/> 
    <bean id="commentValidator" class="rus.domain.CommentValidator"/> 
    <mvc:annotation-driven/> 
    <mvc:resources mapping="/resources/**" location="/resources/"/> 
    <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"> 
     <property name="prefix" value="/WEB-INF/jsp/"/> 
     <property name="suffix" value=".jsp"/> 
    </bean> 
    <bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource"> 
     <property name="basename" value="messages"/> 
    </bean> 
    <!--<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver"> 
     <property name="defaultErrorView" value="error"/> 
    </bean> --> 

<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter"> 
    <constructor-arg ref="roleHierarchy" /> 
</bean> 
<bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"> 
    <property name="hierarchy"> 
     ROLE_ADMIN > ROLE_STAFF 
     ROLE_STAFF > ROLE_USER 
     ROLE_USER > ROLE_GUEST 
    </property> 
</bean> 
</beans> 

Se lanza una excepción:

org.springfram ework.beans.factory.xml.XmlBeanDefinitionStoreException: la línea 35 en el documento XML del recurso ServletContext [/WEB-INF/rus-servlet.xml] no es válida; la excepción anidada es org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element 'property' no puede tener character [children], porque el tipo de contenido del tipo es element-only.

org.xml.sax.SAXParseException: cvc-complex-type.2.3: La 'propiedad' del elemento no puede tener el carácter [hijos], porque el tipo de contenido del tipo es solo elemento.

¿Qué debo hacer para resolver este problema?

Answer 1

La documentación está mal, esto no es válido:

<property name="hierarchy"> 
    ROLE_ADMIN > ROLE_STAFF 
    ROLE_STAFF > ROLE_USER 
    ROLE_USER > ROLE_GUEST 
</property> 

Usted necesita para envolver el contenido dentro de <value>:

<property name="hierarchy"> 
    <value> 
     ROLE_ADMIN > ROLE_STAFF 
     ROLE_STAFF > ROLE_USER 
     ROLE_USER > ROLE_GUEST 
    </value> 
</property> 

Sugiero la presentación de un tema en la SpringSource JIRA, pidiéndoles que corregir los documentos.