Spring Security - Global Method Security using point-cut is not working - spring

Question

I want to apply method level security in my web app so that only authorized users can access those service layer methods.
There are two ways to implement this.
1) To annotate my service layer methods with #Secured annotation and in the dispatcher-servlet.xml file with configuration (<security:global-method-security secured-annotations="enabled" />).
But this would take a lot of time in my case as there are so many service class and methods already created so finding the methods and annotate them will not be a good way.
2) To define a point cut expression for methods level security that will automatically detect the methods having my custom annotation #SecuredAdmin in my services and secure them with the role ROLE_ADMIN.
In my case the option 1) is working very fine when I tried to test. And there is no issue. But when I tried the option 2) with following configuration I am not able to start my application.
<security:global-method-security>
<security:protect-pointcut access="ROLE_ADMIN" expression="execution(#com.xxx.yyy.zzz.services.SecuredAdmin * *.*(..))"/>
</security:global-method-security>
I am getting following exception when I tried to start my server.
java.lang.IllegalArgumentException: error annotation type patterns are only supported at Java 5 compliance level or above
org.aspectj.weaver.tools.PointcutParser.parsePointcutExpression(PointcutParser.java:302)
org.aspectj.weaver.tools.PointcutParser.parsePointcutExpression(PointcutParser.java:279)
org.springframework.security.config.method.ProtectPointcutPostProcessor.postProcessBeforeInitialization(ProtectPointcutPostProcessor.java:94)
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsBeforeInitialization(AbstractAutowireCapableBeanFactory.java:394)
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1448)
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:519)
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:456)
org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:294)
org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:225)
org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:291)
org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
org.springframework.context.support.AbstractApplicationContext.initMessageSource(AbstractApplicationContext.java:773)
org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:452)
org.springframework.web.servlet.FrameworkServlet.configureAndRefreshWebApplicationContext(FrameworkServlet.java:631)
org.springframework.web.servlet.FrameworkServlet.createWebApplicationContext(FrameworkServlet.java:588)
org.springframework.web.servlet.FrameworkServlet.createWebApplicationContext(FrameworkServlet.java:645)
org.springframework.web.servlet.FrameworkServlet.initWebApplicationContext(FrameworkServlet.java:508)
org.springframework.web.servlet.FrameworkServlet.initServletBean(FrameworkServlet.java:449)
org.springframework.web.servlet.HttpServletBean.init(HttpServletBean.java:133)
javax.servlet.GenericServlet.init(GenericServlet.java:160)
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
org.apache.catalina.ha.tcp.ReplicationValve.invoke(ReplicationValve.java:333)
org.apache.catalina.ha.session.JvmRouteBinderValve.invoke(JvmRouteBinderValve.java:219)
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1001)
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:585)
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
java.lang.Thread.run(Unknown Source)
I have tried every possible way to change the code compliance level to 1.6 in both pom files and eclipse project properties.
I am using Spring-Security 3.0 and aspectj related libraries are as following.
spring-aop-3.1.0.RELEASE.jar
spring-aspects-3.1.0.RELEASE.jar
aspectjrt-1.6.5.jar
aspectjweaver-1.6.5.jar
Please help me in this regards. Ask me if you require any further information.
Thanks in advance.

Answer 1

You have to configure aspect weaver to use java 1.6 compliance level. Add something like that to your pom.xml in build plugins section.
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>aspectj-maven-plugin</artifactId>
<version>1.4</version>
<executions>
<execution>
<goals>
<goal>compile</goal>
<goal>test-compile</goal>
</goals>
</execution>
</executions>
<configuration>
<source>1.6</source>
<target>1.6</target>
<encoding>UTF-8</encoding>
<aspectLibraries>
<aspectLibrary>
<groupId>org.springframework</groupId>
<artifactId>spring-aspects</artifactId>
</aspectLibrary>
</aspectLibraries>
</configuration>
</plugin>

Answer 2

I came across this problem with an older project - when I switched from jdk6 to jdk7, when the application started I encountered:
'org.springframework.transaction.annotation.AnnotationTransactionAttributeSource'
while setting bean property 'transactionAttributeSource';
nested exception is org.springframework.beans.factory.BeanCreationException:
Error creating bean with name 'org.springframework.transaction.annotation.AnnotationTransactionAttributeSource#0':
Initialization of bean failed; nested exception is java.lang.IllegalArgumentException:
error annotation type patterns are only supported at Java 5 compliance level or above
I didn't want a purely maven solution because during development I run the app in Tomcat via the IDE (Intellij IDEA).
In the end I just upgraded my aspectjweaver dependency to 1.7.2 (it was 1.5.4)
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjweaver</artifactId>
<version>1.7.2</version>
</dependency>
Everything seems okay now.