Failed to evaluate expression 'IS_AUTHENTICATED_ANONYMOUSLY' Spring 4

12,491

You have 2 errors in your configuration: one regarding <http> element and one regarding ConcurrentSessionFilter.

  1. The class ConcurrentSessionFilter changed from Spring 3 to Spring 4. The constructor taking no parameter, which was deprecated in Spring 3, was removed in Spring 4.

    This explains the error you are getting:

    Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()

    which means that you referenced the no-arg constructor <init> but that it did not exist.

    You need to change your configuration to use the two-args constructor instead:

    <beans:bean id="concurrencyFilter"
    class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <beans:constructor-arg ref="sessionRegistry" />
        <beans:constructor-arg value="/session-expired.htm" />
    </beans:bean>
    
  2. Regarding to the <http> element, you have specified use-expressions="true" but you are not using Spring EL expressions. Quoting the Spring documentation:

    To use expressions to secure individual URLs, you would first need to set the use-expressions attribute in the <http> element to true. Spring Security will then expect the access attributes of the <intercept-url> elements to contain Spring EL expressions.

    As such, you either need to set use-expressions to false explicitely (the default value is true) or change your access attributes to access="hasRole('...').

Share:
12,491

Related videos on Youtube

user1550956
Author by

user1550956

Updated on June 04, 2022

Comments

  • user1550956
    user1550956 almost 2 years

    I upgraded from Spring 3.2.3 + Hibernate 3.8.6 to Spring 4.1.6 + Hibernate 4.3
    now have the following error.
    This is my springSecurityContext.xml:

    Before that I run on Java 7. I want to upgrade to Java 8, should I upgrade spring 4 and Hibernate Help me. Thank

    <global-method-security secured-annotations="enabled"
            pre-post-annotations="enabled" />
        <http auto-config="true" use-expressions="true">
            <form-login login-page="/" authentication-failure-url="/?login_error=1"
                default-target-url="/pages/" />
            <logout logout-url="/j_spring_logout" logout-success-url="/"
                invalidate-session="true" />
            <intercept-url pattern="/pages/**" access="IS_AUTHENTICATED_REMEMBERED" />
            <intercept-url pattern="/WEB-INF/pages/**" access="IS_AUTHENTICATED_REMEMBERED" />
            <intercept-url pattern="/phantichtaichinh/**" access="IS_AUTHENTICATED_REMEMBERED" />
            <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
            <session-management>
                <concurrency-control session-registry-alias="sessionRegistry"/>
            </session-management>
        </http>
        <authentication-manager alias="authenticationManager">
            <authentication-provider user-service-ref="myUserDetailsService">
                <password-encoder ref="passwordEncoder">
                    <salt-source user-property="token" />
                </password-encoder>
            </authentication-provider>
        </authentication-manager>
        <beans:bean id="messageSource"
            class="org.springframework.context.support.ResourceBundleMessageSource">
            <beans:property name="basenames">
                <beans:list>
                    <beans:value>mymessages</beans:value>
                </beans:list>
            </beans:property>
        </beans:bean>
        <beans:bean id="myUserDetailsService" class="com.evnit.fmis.policy.model.PolicyManager">
            <beans:property name="userService" ref="userService" />
        </beans:bean>
        <beans:bean id="passwordEncoder"
            class="com.evnit.fmis.policy.model.PasswordEncoderImpl">
        </beans:bean>
        <beans:bean id="LoginLoggingPolicyService"
            class="com.evnit.fmis.policy.model.LoginLoggingPolicyService" scope="session">
            <beans:property name="guiLoginLoggingPolicService" ref="guiLoginLoggingPolicService" />
        </beans:bean>
        <aop:config>
            <aop:aspect id="LoginLoggingAspect" ref="LoginLoggingPolicyService">
                <aop:pointcut id="authPointcut"
                    expression="execution(public org.springframework.security.core.Authentication org.springframework.security.authentication.AuthenticationProvider.authenticate(org.springframework.security.core.Authentication))" />
                <aop:around pointcut-ref="authPointcut" method="loginLogging" />
            </aop:aspect>
        </aop:config>
        <beans:bean id="concurrencyFilter"
            class="org.springframework.security.web.session.ConcurrentSessionFilter">
            <beans:property name="sessionRegistry" ref="sessionRegistry" />
            <beans:property name="expiredUrl" value="/session-expired.htm" />
        </beans:bean>
        <beans:bean id="myAuthFilter"
            class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
            <beans:property name="sessionAuthenticationStrategy"
                ref="sas" />
            <beans:property name="authenticationManager" ref="authenticationManager" />
        </beans:bean>
        <beans:bean id="sas"
            class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
            <beans:constructor-arg>
                <beans:list>
                    <beans:bean
                        class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
                        <beans:constructor-arg ref="sessionRegistry" />
                        <beans:property name="maximumSessions" value="1" />
                        <beans:property name="exceptionIfMaximumExceeded"
                            value="true" />
                    </beans:bean>
                    <beans:bean
                        class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
                    </beans:bean>
                    <beans:bean
                        class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
                        <beans:constructor-arg ref="sessionRegistry" />
                    </beans:bean>
                </beans:list>
            </beans:constructor-arg>
        </beans:bean>
        <beans:bean id="sessionRegistry"
            class="org.springframework.security.core.session.SessionRegistryImpl" />
    

    Description error

    java.lang.IllegalArgumentException: Failed to evaluate expression 'IS_AUTHENTICATED_ANONYMOUSLY'
        at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:14)
        at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:36)
        at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:18)
        at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:62)
        at org.springframework.security.config.http.DefaultFilterChainValidator.checkLoginPageIsntProtected(DefaultFilterChainValidator.java:191)
        at org.springframework.security.config.http.DefaultFilterChainValidator.validate(DefaultFilterChainValidator.java:36)
        at org.springframework.security.web.FilterChainProxy.afterPropertiesSet(FilterChainProxy.java:167)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1633)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1570)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:539)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
        at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
        at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
    Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E:(pos 0): Property or field 'IS_AUTHENTICATED_ANONYMOUSLY' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot' - maybe not public?
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.readProperty(PropertyOrFieldReference.java:226)
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:93)
        at org.springframework.expression.spel.ast.PropertyOrFieldReference.getValueInternal(PropertyOrFieldReference.java:81)
        at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:131)
        at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:299)
        at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:11)
        ... 29 more
    2015-10-27 14:23:43,006 WARN   [localhost-startStop-1] XmlWebApplicationContext M[refresh] --> Exception encountered during context initialization - cancelling refresh attempt
    org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'concurrencyFilter' defined in class path resource [springSecurityContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1101)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1046)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
        at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
        at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
    Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:85)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1094)
        ... 22 more
    Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at java.lang.Class.getConstructor0(Class.java:3082)
        at java.lang.Class.getDeclaredConstructor(Class.java:2178)
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:80)
        ... 23 more
    2015-10-27 14:23:43,037 INFO   [localhost-startStop-1] RmiServiceExporter M[destroy] --> Unbinding RMI service 'TransferService' from registry at port '1199'
    2015-10-27 14:23:43,037 INFO   [localhost-startStop-1] LocalContainerEntityManagerFactoryBean M[destroy] --> Closing JPA EntityManagerFactory for persistence unit 'fmis2'
    2015-10-27 14:23:43,037 ERROR  [localhost-startStop-1] ContextLoader M[initWebApplicationContext] --> Context initialization failed
    org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'concurrencyFilter' defined in class path resource [springSecurityContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1101)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1046)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
        at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
        at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
    Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:85)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1094)
        ... 22 more
    Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at java.lang.Class.getConstructor0(Class.java:3082)
        at java.lang.Class.getDeclaredConstructor(Class.java:2178)
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:80)
        ... 23 more
    Oct 27, 2015 2:23:43 PM org.apache.catalina.core.StandardContext listenerStart
    SEVERE: Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener
    org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'concurrencyFilter' defined in class path resource [springSecurityContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1101)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1046)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:504)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:476)
        at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:303)
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:299)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194)
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:755)
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:757)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:480)
        at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:106)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4738)
        at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5181)
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1408)
        at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1398)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
    Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.session.ConcurrentSessionFilter]: No default constructor found; nested exception is java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:85)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateBean(AbstractAutowireCapableBeanFactory.java:1094)
        ... 22 more
    Caused by: java.lang.NoSuchMethodException: org.springframework.security.web.session.ConcurrentSessionFilter.<init>()
        at java.lang.Class.getConstructor0(Class.java:3082)
        at java.lang.Class.getDeclaredConstructor(Class.java:2178)
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:80)
        ... 23 more
    
  • user1550956
    user1550956 over 8 years
    Thank you. I config start server success. But when running the browser app notifications The server is temporarily unable to serve. Do you want to retry. (403: Forbidden)
  • Tunaki
    Tunaki over 8 years
    @user1550956 That sounds like a very different error. You should create another question about this.
  • user1550956
    user1550956 over 8 years
    I edit <beans:bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSe‌​ssionFilter"> <beans:constructor-arg ref="sessionRegistry"/> <beans:constructor-arg value="/session-expired.htm"/> </beans:bean>