Spring Security - externalize value of "requires-channel" - spring

Question

I need to support both HTTP and HTTPS in my Spring Security file and dynamically switch between those at runtime.
So I am trying to create properties file which would contain one of any/http/https, but that won't parse the XML config.
Spring Security config:
<sec:http entry-point-ref="portalEntryPoint">
<sec:anonymous />
<sec:intercept-url pattern = "/portal" access="IS_AUTHENTICATED_ANONYMOUSLY"
requires-channel="${user-security.login.channel}" />
<!-- rest omitted -->
</sec:http>
Properties file:
user-security.login.channel=https
I am getting following error:
Caused by: org.xml.sax.SAXParseException: cvc-enumeration-valid: Value '${user-security.login.channel}' is not facet-valid with respect to enumeration '[http, https, any]'. It must be a value from the enumeration.
I am using Spring 3 and Spring Security 2. Any ideas?

Answer 1

If you absolutely MUST then use profiles to configure your portal entry point. Obviously this means a lot of copy and paste in your spring config ....
Example from springsource docs :
<bean id="transferService" class="com.bank.service.internal.DefaultTransferService">
<constructor-arg ref="accountRepository"/>
<constructor-arg ref="feePolicy"/>
</bean>
<bean id="accountRepository" class="com.bank.repository.internal.JdbcAccountRepository">
<constructor-arg ref="dataSource"/>
</bean>
<bean id="feePolicy" class="com.bank.service.internal.ZeroFeePolicy"/>
<beans profile="dev">
<jdbc:embedded-database id="dataSource">
<jdbc:script location="classpath:com/bank/config/sql/schema.sql"/>
<jdbc:script location="classpath:com/bank/config/sql/test-data.sql"/>
</jdbc:embedded-database>
</beans>
<beans profile="production">
<jee:jndi-lookup id="dataSource" jndi-name="java:comp/env/jdbc/datasource"/>
</beans>
link http://blog.springsource.com/2011/02/14/spring-3-1-m1-introducing-profile/

Answer 2

This was not possible in Spring Security 2, you must use Spring Security 3.0+
There was an issue filed regarding this support that was fixed prior to the release of Spring Security 3.0.