Styjun

I have a Spring Webflow application that has an on-start entry that sets up a number of context variables related to the current user of the application - their ID, their application role, etc. One of the on-start method invocations fails, throwing the following error

org.springframework.expression.spel.SpelEvaluationExpression EL1004E: Method call userisAuthorized(java.lang.String,null) cannot be found on com.sun.proxy.$Proxy61 type

org.springframework.webflow.execution ActionExecutionException: Exception thrown executing [AnnotatedAction@18864e3f targetAction = [EvaluateAction@197b16ad expression = userService.userisAuthorized(flowScope.UserUid, flowScope.isRoleBased), resultExpression = flowScope.userAuthorized, attributes = map[[empty]]] in state 'null' of flow 'requestAccess' -- action execution attributes were 'map[[empty]]'

The real problem however is this: the app actually does in fact successfully call the userisAuthorized method on the userService bean for all except one particular user.

Doing some dynamic debugging and referencing this helpful SO post Listing Aspect-proxied beans in Spring I've been able to determine that the auto wiring does in fact find the userService. But it's loaded into the application context as com.sun.proxy.$Proxy63, not $Proxy61.

Since the error seems related to the user logged in at the time of the call, I'm guessing there might be some other proxy injected into the context prior to the actual userService, perhaps related to Spring security config, that Spring is for some reason getting confused with the actual proxy for the userService bean. But I can't for the life of me figure out why that would happen - there simply is no other class anywhere in the app that has a isuserAuthorized method and in any case the Spring security config is not scanning the service package anyway.

security config

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:tx="http://www.springframework.org/schema/tx"
 xmlns:security="http://www.springframework.org/schema/security"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns:context="http://www.springframework.org/schema/context"
 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
 http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.1.xsd
 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">

 <!-- Enable auto-wiring -->
 <context:annotation-config/>

 <!-- Scan for auto-wiring classes in spring saml packages --> <=== package that have security proxies do NOT include service
 <context:component-scan base-package="org.trinityhealth.sarequest.security"/>
 <context:component-scan base-package="org.trinityhealth.sarequest.dao" />
 <context:component-scan base-package="org.trinityhealth.sarequest.model" />

webflow config

<?xml version="1.0" encoding="UTF-8"?>
<flow xmlns="http://www.springframework.org/schema/webflow"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.springframework.org/schema/webflow
 http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">

 <on-start>
 <evaluate expression="systemAccessService.populateUserInformation(flowScope.accessRequest)" />
 <evaluate expression="externalContext.globalSessionMap.userUid" result="flowScope.userUid"/>
 <evaluate expression="externalContext.globalSessionMap.isRoleBased" result="flowScope.isRoleBased"/>
 <evaluate expression="externalContext.globalSessionMap.userRhmId" result="flowScope.userRhmId"/>
 <evaluate expression="userService.userisAuthorized(flowScope.userUid, flowScope.isRoleBased)" result="flowScope.userAuthorized"/> <=== the failing method call
 <evaluate expression="userService.readRoleFromSecurityContext()" result="flowScope.loggedInUserRole"/>
 <set name="conversationScope.hideSteps" value="'N'" />
 </on-start>
.
.
.

the service bean interface

package org.trinityhealth.sarequest.service; <=== not in security, dao, or model package
.
. various import statements
.
public interface UserService 
.
. bunch of method definitions, none named userisAuthorized or having a (String,char) signature
.
 public boolean userisAuthorized(String thisUserId, char isRoleBased);


.
.
.

the service bean implementation w/annotations

package org.trinityhealth.sarequest.service; <=== not in security, dao, or model package
.
. various import statements
.
@Service("userService")
public class UserServiceImpl implements UserService 
.
. bunch of implemented Methods, none named userisAuthorized or having a (String,char) signature 
.
 @Override
 @Transactional
 public boolean userisAuthorized(String thisUserId, char isRoleBased) 
.
. implementation of userisAuthorized, which works if on-start expresssion selects correct bean
.