@PreAuthorize gives AuthenticationCredentialsNotFoundException .Am I missing out something?

[supriya riya]

Hi,

I am new to spring.I am trying to implement method level permission access using @PreAuthorize annotation.
Please find below all the code I have written to build sample application.
I have made changes to my web.xml,mvcWeb-servlet.xml mvcWeb-security-servlet.xml.
I am getting below exception when it reaches HelloWebPermissionEvaluator class which implements PermissionEvaluator.

public class HelloWebPermissionEvaluator implements PermissionEvaluator {

	private static final Logger LOGGER = Logger.getLogger(HelloWebPermissionEvaluator.class);

	@Override
	public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
		boolean hasPermission = false;
		try {
			if (!hasPermission && canHandle(authentication, targetDomainObject, permission)) {
				hasPermission = checkPermission(authentication, targetDomainObject, (String) permission);
			} else {
				LOGGER.error("Logged In user does not have access to this resource.");
			}
		} catch (Exception e) {
			LOGGER.error("Logged In user does have access to this resource.");
		}
		return hasPermission;
	}

	private boolean canHandle(Authentication authentication, Object targetDomainObject, Object permission) {
		return targetDomainObject != null && authentication != null && permission instanceof String;
	}

	private boolean checkPermission(Authentication authentication, Object targetDomainObject, String permissionKey) {
		Permission permission = new OperationPermission();
		return permission.isAllowed(authentication, targetDomainObject, permissionKey);
	}


	@Override
	public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
		// TODO Auto-generated method stub
		return false;
	}
}


/**EmployeeController*****/

@Controller
public class EmployeeController {


	@Autowired
	AuditService auditService;

	

	@RequestMapping(value = "/viewEmployeeAudit", method = RequestMethod.GET)
	@ResponseBody
	@PreAuthorize("hasPermission(new Object(),'Allow')")
	public Audit viewAudit(@RequestParam(value = "auditId", required = true) Integer auditId) throws HelloWebException {
		return auditService.viewAudit(auditId);
	}

/****Web.xml***/


<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://java.sun.com/xml/ns/javaee" xmlns:jsp="http://java.sun.com/xml/ns/javaee/jsp"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
	version="3.0">

    <display-name>Spring MVC Local Example</display-name>

    <context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
			classpath:mvcWeb-servlet.xml
			classpath:mvcWeb-security-servlet.xml
		</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
    <servlet>
        <servlet-name>mvcWeb</servlet-name>
        <servlet-class>
           org.springframework.web.servlet.DispatcherServlet
        </servlet-class>
        <init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value></param-value>
		</init-param>
              <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>mvcWeb</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

</web-app>


/***********mvcWeb-security-servlet**********/


<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">


		<security:global-method-security  pre-post-annotations="enabled">
		<security:expression-handler ref="expressionHandler" />
	        </security:global-method-security>

		<bean id="expressionHandler"
		class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
		<property name="permissionEvaluator" ref="HelloWebPermissionEvaluator" />
	</bean>

   <bean id="HelloWebPermissionEvaluator" class="com.mypackage.permission.HelloWebPermissionEvaluator" />
   </beans>

Do I have to add any thing more?Am I missing out something.

I am getting exception

SEVERE: Servlet.service() for servlet [mvcWeb] in context with path [/TestWeb] threw exception [Request processing failed; nested exception is org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext] with root cause
org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:378)
	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:222)
	at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:64)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
	at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:653)
	at com.mypackage.EmployeeController$$EnhancerBySpringCGLIB$$68f99556.viewAudit(<generated>)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	
	

Thanks!