Java: Spring security 3 Role hierarchy

Question

I am using Spring framework mvc 3 + spring security 3. I would like to enable role hierarchy in my spring security. According to http://static.springsource.org/spring-security/site/docs/3.1.x/reference/authz-arch.html i should write

<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
    <constructor-arg ref="roleHierarchy" />
</bean>
<bean id="roleHierarchy"
    class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
<property name="hierarchy">
    ROLE_ADMIN > ROLE_STAFF
    ROLE_STAFF > ROLE_USER
    ROLE_USER > ROLE_GUEST
</property>
</bean>

But where should i put it? I tried to put it into my app-security.xml:

<beans:beans xmlns="http://www.springframework.org/schema/security" 
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    <http>
        <intercept-url pattern="/entryPost/**" access="ROLE_USER" requires-channel="https"/>
        <intercept-url pattern="/entryDelete/**" access="ROLE_ADMIN" requires-channel="https"/>
        <intercept-url pattern="/commentDelete/**" access="ROLE_ADMIN" requires-channel="https"/>
        <intercept-url pattern="/login" access="ROLE_ANONYMOUS" requires-channel="https"/>
        <form-login login-page="/login" default-target-url="/entryList/1" authentication-failure-url="/login?error=true" />
        <logout logout-success-url="/login" />
        <session-management>
            <concurrency-control max-sessions="1" />
        </session-management>
        <access-denied-handler error-page="/accessDenied"/>
    </http>
    <authentication-manager>
        <authentication-provider>
            <jdbc-user-service data-source-ref="dataSource"
            users-by-username-query="SELECT username,password,'true' as enabled FROM member WHERE username=?"
            authorities-by-username-query="SELECT member.username,role FROM member,memberRole WHERE member.username=? AND member.id=memberRole.member_id"/>
        </authentication-provider>
    </authentication-manager>
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
    <constructor-arg ref="roleHierarchy" />
</bean>
<bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
    <property name="hierarchy">
        ROLE_ADMIN > ROLE_STAFF
        ROLE_STAFF > ROLE_USER
        ROLE_USER > ROLE_GUEST
    </property>
</bean>

But it doesn't work: HTTP Status 404.

When I put it into app-servlet.xml:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" 
xmlns:mvc="http://www.springframework.org/schema/mvc" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:context="http://www.springframework.org/schema/context" 
xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/context 
    http://www.springframework.org/schema/context/spring-context-3.0.xsd 
    http://www.springframework.org/schema/mvc 
    http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
    <context:component-scan base-package="rus.web"/>
    <bean id="entryValidator" class="rus.domain.EntryValidator"/>
    <bean id="commentValidator" class="rus.domain.CommentValidator"/>
    <mvc:annotation-driven/>
    <mvc:resources mapping="/resources/**" location="/resources/"/>
    <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix" value="/WEB-INF/jsp/"/>
        <property name="suffix" value=".jsp"/>
    </bean>
    <bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">
        <property name="basename" value="messages"/>
    </bean>
    <!--<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="defaultErrorView" value="error"/>
    </bean> -->

<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
    <constructor-arg ref="roleHierarchy" />
</bean>
<bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
    <property name="hierarchy">
        ROLE_ADMIN > ROLE_STAFF
        ROLE_STAFF > ROLE_USER
        ROLE_USER > ROLE_GUEST
    </property>
</bean>
</beans>

It throws exception:

org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 35 in XML document from ServletContext resource [/WEB-INF/rus-servlet.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element 'property' cannot have character [children], because the type's content type is element-only.

org.xml.sax.SAXParseException: cvc-complex-type.2.3: Element 'property' cannot have character [children], because the type's content type is element-only.

What should I do to solve this problem?

Answer 1

The documentation is wrong, this is not valid:

<property name="hierarchy">
    ROLE_ADMIN > ROLE_STAFF
    ROLE_STAFF > ROLE_USER
    ROLE_USER > ROLE_GUEST
</property>

You need to wrap the contents inside <value>:

<property name="hierarchy">
   <value>
      ROLE_ADMIN > ROLE_STAFF
      ROLE_STAFF > ROLE_USER
      ROLE_USER > ROLE_GUEST
   </value>
</property>

I suggest filing an issue on the SpringSource JIRA, asking them to fix the docs.