3

Im trying to setup multiple filter chains as follows in Spring Security and running into a weird issue. 

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration {

    @Configuration("apiWebSecurityConfigurationAdapter")
    public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        ....
    }


    @Configuration("ssoWebSecurityConfigurerAdapter")
    @Order(1)
    public static class SSOWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
        private Timer backgroundTaskTimer;
        private MultiThreadedHttpConnectionManager multiThreadedHttpConnectionManager;

        @PostConstruct
        public void init() {
            this.backgroundTaskTimer = new Timer(true);
            this.multiThreadedHttpConnectionManager = new MultiThreadedHttpConnectionManager();
        }

        @PreDestroy
        public void destroy() {
            this.backgroundTaskTimer.purge();
            this.backgroundTaskTimer.cancel();
            this.multiThreadedHttpConnectionManager.shutdown();
        }

        @Bean
        @Qualifier("idp-test")
        public ExtendedMetadataDelegate openiamExtendedMetadataProvider()
                throws MetadataProviderException, ResourceException {
            DefaultResourceLoader loader = new DefaultResourceLoader();
            String metadataLocation = "classpath:/sso/idp-test.xml";
            ResourceBackedMetadataProvider resourceBackedMetadataProvider =
                    new ResourceBackedMetadataProvider(backgroundTaskTimer,
                            new SpringResourceWrapperOpenSAMLResource(loader.getResource(metadataLocation.trim()))); // backgroundTaskTimer is null

            resourceBackedMetadataProvider.setParserPool(parserPool());
            ExtendedMetadataDelegate extendedMetadataDelegate =
                    new ExtendedMetadataDelegate(resourceBackedMetadataProvider, extendedMetadata());
            extendedMetadataDelegate.setMetadataTrustCheck(true);
            extendedMetadataDelegate.setMetadataRequireSignature(false);
            backgroundTaskTimer.purge();
            return extendedMetadataDelegate;
        }

        .....
    }
}

It causes the error,

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.saml.metadata.ExtendedMetadataDelegate]: Circular reference involving containing bean 'ssoWebSecurityConfigurerAdapter' - consider declaring the factory method as static for independence from its containing instance. Factory method 'testExtendedMetadataProvider' threw exception; nested exception is java.lang.IllegalArgumentException: Task timer may not be null
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588)
    ... 114 common frames omitted
Caused by: java.lang.IllegalArgumentException: Task timer may not be null
    at org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider.<init>(AbstractReloadingMetadataProvider.java:105)
    at org.opensaml.saml2.metadata.provider.ResourceBackedMetadataProvider.<init>(ResourceBackedMetadataProvider.java:76)

Why doesnt backgroundTaskTimer in the above case get set inside the PostConstruct ?

nixgadget
  • 6,983
  • 16
  • 70
  • 103
  • Have you tried to debug it? I have written few snippets with similar configuration and everything works perfectly. – Rafal G. Oct 10 '17 at 06:41
  • Do you have any custom bean post processors or smth like that? – Leffchik Oct 10 '17 at 06:46
  • No custom bean processors. Strangely works fine with non static class. – nixgadget Oct 10 '17 at 06:49
  • I expect it's got something to do with that `Circular reference involving containing bean 'ssoWebSecurityConfigurerAdapter'`... I don't see it in the example – ptomli Oct 10 '17 at 07:19

0 Answers0