带有@PreAuthorize 注解的java.lang.NoSuchMethodError

Question

我在 Tomcat 7 中使用 Spring Security 3。我的 http 标签定义是这样的:

<http auto-config="false" disable-url-rewriting="true" 
entry-point-ref="loginUrlAuthenticationEntryPoint" use-expressions="true">
...

但是当我想像这样使用基于方法的安全性时:

@RequestMapping(method = RequestMethod.GET)
@PreAuthorize("hasRole('ROLE_USER')")
public
@ResponseBody
List<Lenhos> getAllLenhosInJSON() {
    return new ArrayList<Lenhos>(lenhoMap.values());
}

然后运行我的应用程序，我在 Web 端收到 404 not found 错误，在 Tomcat 上的错误如下:

ERROR ContextLoader:220 - Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'LenhoConf' defined in file [/web-core/target/web-core/WEB-INF/classes/com/almen/donho/webcore/controller/LenhoConf.class]: Initialization of bean failed; nested exception is java.lang.NoSuchMethodError: org.objectweb.asm.ClassWriter.<init>(I)V
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:527)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:456)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:291)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:288)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:190)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:580)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:895)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:425)
    at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:276)
    at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:197)
    at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)
    at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4681)
    at org.apache.catalina.core.StandardContext$1.call(StandardContext.java:5184)
    at org.apache.catalina.core.StandardContext$1.call(StandardContext.java:5179)
    at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
    at java.util.concurrent.FutureTask.run(FutureTask.java:166)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
    at java.lang.Thread.run(Thread.java:636)
Caused by: java.lang.NoSuchMethodError: org.objectweb.asm.ClassWriter.<init>(I)V
    at net.sf.cglib.core.DebuggingClassWriter.<init>(DebuggingClassWriter.java:47)
    at net.sf.cglib.core.DefaultGeneratorStrategy.getClassWriter(DefaultGeneratorStrategy.java:30)
    at net.sf.cglib.core.DefaultGeneratorStrategy.generate(DefaultGeneratorStrategy.java:24)
    at net.sf.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:216)
    at net.sf.cglib.core.KeyFactory$Generator.create(KeyFactory.java:144)
    at net.sf.cglib.core.KeyFactory.create(KeyFactory.java:116)
    at net.sf.cglib.core.KeyFactory.create(KeyFactory.java:108)
    at net.sf.cglib.core.KeyFactory.create(KeyFactory.java:104)
    at net.sf.cglib.proxy.Enhancer.<clinit>(Enhancer.java:69)
    at org.springframework.aop.framework.Cglib2AopProxy.createEnhancer(Cglib2AopProxy.java:228)
    at org.springframework.aop.framework.Cglib2AopProxy.getProxy(Cglib2AopProxy.java:170)
    at org.springframework.aop.framework.ProxyFactory.getProxy(ProxyFactory.java:112)
    at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.createProxy(AbstractAutoProxyCreator.java:476)
    at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.wrapIfNecessary(AbstractAutoProxyCreator.java:362)
    at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.postProcessAfterInitialization(AbstractAutoProxyCreator.java:322)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsAfterInitialization(AbstractAutowireCapableBeanFactory.java:407)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1426)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:519)
    ... 19 more

添加 @PreAuthorize("hasRole('ROLE_USER')") 时出错。该错误的原因可能是什么？

PS:1 我的pom.xml文件如下:

<properties>
    <spring.version>3.0.5.RELEASE</spring.version>
</properties>

<!-- Spring 3 dependencies -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-web</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Spring security dependencies -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-core</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>${spring.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Jackson JSON Mapper -->
    <dependency>
        <groupId>org.codehaus.jackson</groupId>
        <artifactId>jackson-mapper-asl</artifactId>
        <version>1.7.1</version>
    </dependency>

    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>servlet-api</artifactId>
        <version>2.4</version>
        <scope>provided</scope>
    </dependency>

<build>
    <finalName>web-core</finalName>
    <plugins>
        <plugin>
            <artifactId>maven-compiler-plugin</artifactId>
            <configuration>
                <source>1.6</source>
                <target>1.6</target>
            </configuration>
        </plugin>
    </plugins>
</build>

我没有在我的项目中使用 hibernate，但是我将一些模块(我使用 Intellij IDEA)导入到我的应用程序中并且它们使用了。当我运行我的应用程序时，没有任何与 Hibernate 相关的运行。我是 Spring 的新手。

PS 2:这是我的依赖树:

[INFO] [dependency:tree {execution: default-cli}]
[INFO] xxx:web-core:war:1.0-SNAPSHOT
[INFO] +- :xxx-yyy:jar:1.0-SNAPSHOT:compile
[INFO] |  +- org.springframework:spring-aop:jar:3.0.5.RELEASE:compile
[INFO] |  \- org.hibernate:hibernate-entitymanager:jar:3.6.6.Final:compile
[INFO] |     \- cglib:cglib:jar:2.2:compile
[INFO] \- xxx:zzz:jar:1.0-SNAPSHOT:compile
[INFO]    \- org.hibernate:hibernate:jar:3.2.7.ga:compile
[INFO]       +- asm:asm-attrs:jar:1.5.3:compile
[INFO]       \- asm:asm:jar:1.5.3:compile

yyy 和 zzz 我使用的应用程序的其他模块。

PS 3:我的新依赖树:

[INFO] xxx:web-core:war:1.0-SNAPSHOT
[INFO] \- xxx-yyy:jar:1.0-SNAPSHOT:compile
[INFO]    +- org.springframework:spring-aop:jar:3.0.5.RELEASE:compile
[INFO]    +- org.hibernate:hibernate-commons-annotations:jar:3.3.0.ga:compile
[INFO]    |  \- org.hibernate:hibernate:jar:3.2.1.ga:compile
[INFO]    |     +- asm:asm-attrs:jar:1.5.3:compile
[INFO]    |     \- asm:asm:jar:1.5.3:compile
[INFO]    \- org.hibernate:hibernate-entitymanager:jar:3.6.6.Final:compile
[INFO]       \- cglib:cglib:jar:2.2:compile

Answer 1

NoSuchMethodError 似乎暗示您正在使用不同版本的 ObjectWeb ASM比那个 CGLIB使用(由 Spring AOP 用于动态生成类)。

我建议您检查您用来运行此代码的 ASM 和 CGLIB JAR 是否与 Spring Security 3 发行版中的兼容。

更新:查看Spring 2.0 AOP: ASM Dependencies Spring 论坛上的线程。它是关于 Spring 2 AOP 的，但错误看起来非常相似，所以解决方案可能与我相同。

更新 2:查看您的依赖关系树，我会说您的大部分问题都源于您的依赖关系树中有两个版本的 Hibernate:

1. xxx:zzz:jar 依赖于 org.hibernate:hibernate:jar:3.2.7.ga
2. xxx-yyy:jar 依赖于 org.hibernate:hibernate-entitymanager:jar:3.6.6.Final

我建议更新 xxx:zzz:jar 项目以也使用 3.6.6.Final 版本的 Hibernate。

这应该可以解决问题，因为 Hibernate 3.6.6 和 Spring AOP 3.0.5 都依赖于 CGLIB 2.2。