[SHIRO-829] beanPostProcessor and FactoryBean cause aop to fail in the same Configuration

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Resolved
• Affects Version/s: 1.7.1
• Fix Version/s: 1.9.0
• Component/s: Integration: Spring
• Environment: springboot:1.5.21.RELEASE ; spring:4.3.24.RELEASE

Language

Java

• Assignee: Francois Papon
• Reporter: chenzhi.xu
• Created: 03/Aug/21 10:32
• Updated: 08/Feb/22 18:15
• Resolved: 08/Feb/22 18:15

Description

When LifecycleBeanPostProcessor and ShiroFilterFactoryBean are defined in the same configuration class, Realm's dependency aop (@Transactional and cache) is invalidated. Please look below:

@Configuration
public class ShiroConfig {
    @Bean("lifecycleBeanPostProcessor")
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }
    @Bean("securityManager")
    public SecurityManager securityManager(OAuth2Realm oAuth2Realm) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(oAuth2Realm);
        securityManager.setRememberMeManager(null);
        return securityManager;
    }
    @Bean("shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        return shiroFilter;
    }
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }
}

@Slf4j
@Component
public class OAuth2Realm extends AuthorizingRealm {
    @Autowired
    private ISysSsoService sysSsoService;

    ......
}

When the ISysSsoService method is annotated by @Transactional, @Transactional will become invalid.

I can fix it like this

@Configuration
public class ShiroConfig {
    public static class LifecycleBeanPostProcessorConfiguration {
        @Bean("lifecycleBeanPostProcessor")
        public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
            return new LifecycleBeanPostProcessor();
        }
    }
    ......
}

But I think this is a bug

see spring-beans-4.3.24.RELEASE.jar org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory#getTypeForFactoryBean

At 1 in the figure, we want to parse the return type of the FactoryBean, and enter the logic of Figure 2 when it cannot be parsed according to the signature. Because LifecycleBeanPostProcessor is initialized earlier than the ordinary bean, the Configuration class already exists as a FactoryBean, so that the dependent instantiation will continue.

I have found a solution to change the signature of ShiroFilterFactoryBean to

public class ShiroFilterFactoryBean implements FactoryBean<AbstractShiroFilter>, BeanPostProcessor 

 

Issue Links

• is related to: SHIRO-859 Remove shiro-web dependency from the Spring integrations
• links to: GitHub Pull Request #316