Spring -security - AccessDecisionVoter-impl will not be called

Question

I am trying to create a custom AccessDecisionVoter and just stop it being debugged when it is called.

I put a break point in each method, but nothing happened.

spring -security.xml:

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"> <property name="decisionVoters"> <list> <bean class="com.affiliates.server.security.voters.VoterTest"> <property name="brandsApi" ref="brandsApi"/> </bean> </list> </property> 

IBrandsApi.java

  public interface IBrandsApi { IHibernateBean getByPK(Integer id); @Secured({ "ROLE_BRAND_ADMIN" }) IHibernateBean update(IHibernateBean brand); @Secured({ "ROLE_BRAND_ADMIN" }) IHibernateBean insert(IHibernateBean brand); @Secured({ "ROLE_BRAND_ADMIN" }) ResultContainer getAll(IFilter filter); @Secured({ "ROLE_ADMIN" }) Integer delete(IFilter filter); } 

VoterTest.java (empty file with breakpoints)

  public class VoterTest implements AccessDecisionVoter { private IBrandsApi brandsApi; public IBrandsApi getBrandsApi() { return brandsApi; } public void setBrandsApi(IBrandsApi brandsApi) { this.brandsApi = brandsApi; } @Override public boolean supports(ConfigAttribute attribute) { System.out.println("here"); return false; } @Override public boolean supports(Class<?> clazz) { System.out.println("here"); return false; } @Override public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) { System.out.println("here"); return 0; } } 

By the way, there were no exceptions thrown during the download / launch of the application Thanks

Answer 1

You need to use your custom AccessDecisionManager, otherwise it is used by default. You can do it with

 <global-method-security access-decision-manager-ref="accessDecisionManager"/> 

See the documentation for more information about this.

One more thing: the supports() methods in your voter should probably return true otherwise vote() will not be called.