Method Security in GraalVM Native Image :: Spring Security
Why Spring
Overview
Trending
Generative AI
Cloud
Architecture Patterns
Microservices
Reactive
Event Driven
Application Types
Web Applications
Serverless
Batch
Learn
Getting Started
Quickstart
Guides
Academy
Courses
Get Certified
Projects
Overview
Projects
Spring Boot
Spring Framework
Spring Cloud
Spring AI
Spring Data
Spring Integration
Spring Batch
Spring Security
Foundational Projects
Micrometer
Reactor
Development Tools
Spring Tools
Spring Initializr
Resources
Blog
Release Calendar
Version Mappings
Release Highlights
Security Advisories
GitHub Orgs
Spring Projects
Spring Cloud
Community
Overview
Events
Authors
Enterprise
Overview
Long-term Support
Automated Upgrades
Governance and Compliance
Modern App Development
light
Spring Security
7.1.1-SNAPSHOT
Search
Overview
Prerequisites
Community
What’s New
Preparing for 8.0
Migrating to 7
Servlet
Authorization
OAuth 2.0
SAML 2.0
Reactive
Getting Spring Security
Javadoc
KDoc
Features
Authentication
Password Storage
Authorization
Protection Against Exploits
CSRF
HTTP Headers
HTTP Requests
Integrations
REST Client
HTTP Service Clients
Cryptography
Spring Data
Java’s Concurrency APIs
Jackson
Localization
Project Modules
Samples
Servlet Applications
Getting Started
Architecture
Authentication
Authentication Architecture
Username/Password
Reading Username/Password
Form
Basic
Digest
Password Storage
In Memory
JDBC
UserDetails
CredentialsContainer
Password Erasure
UserDetailsService
PasswordEncoder
DaoAuthenticationProvider
LDAP
Multi-Factor Authentication
Persistence
Passkeys
One-Time Token
Session Management
Remember Me
Anonymous
Pre-Authentication
JAAS
CAS
X509
Run-As
Logout
Authentication Events
Kerberos
Introduction
Reference
Samples
Appendices
Authorization
Authorization Architecture
Authorize HTTP Requests
Method Security
Domain Object Security ACLs
Authorization Events
OAuth2
OAuth2 Log In
Core Configuration
Advanced Configuration
OIDC Logout
OAuth2 Client
Core Interfaces and Classes
OAuth2 Authorization Grants
OAuth2 Client Authentication
OAuth2 Authorized Clients
OAuth2 Resource Server
JWT
Opaque Token
Multitenancy
Bearer Tokens
DPoP-bound Access Tokens
Protected Resource Metadata
OAuth2 Authorization Server
Getting Started
Configuration Model
Core Model / Components
Protocol Endpoints
SAML2
SAML2 Log In
SAML2 Log In Overview
SAML2 Authentication Requests
SAML2 Authentication Responses
SAML2 Logout
SAML2 Metadata
Migrating from Spring Security SAML Extension
Protection Against Exploits
Cross Site Request Forgery (CSRF)
Security HTTP Response Headers
HTTP
HttpFirewall
Integrations
Concurrency
Localization
Servlet APIs
Spring Data
Spring MVC
WebSocket
Spring’s CORS Support
JSP Taglib
Observability
Configuration
Java Configuration
Kotlin Configuration
Namespace Configuration
Testing
Method Security
MockMvc Support
MockMvc Setup
Security RequestPostProcessors
Mocking Users
Mocking CSRF
Mocking Form Login
Mocking HTTP Basic
Mocking OAuth2
Mocking Logout
Security RequestBuilders
Security ResultMatchers
Security ResultHandlers
Appendix
Database Schemas
XML Namespace
Authentication Services
Web Security
Method Security
LDAP Security
WebSocket Security
Proxy Server Configuration
FAQ
Reactive Applications
Getting Started
Authentication
X.509 Authentication
Logout
Session Management
Concurrent Sessions Control
Authorization
Authorize HTTP Requests
EnableReactiveMethodSecurity
OAuth2
OAuth2 Log In
Core Configuration
Advanced Configuration
OIDC Logout
OAuth2 Client
Core Interfaces and Classes
OAuth2 Authorization Grants
OAuth2 Client Authentication
OAuth2 Authorized Clients
OAuth2 Resource Server
JWT
Opaque Token
Multitenancy
Bearer Tokens
Protection Against Exploits
CSRF
Headers
HTTP Requests
ServerWebExchangeFirewall
Integrations
CORS
RSocket
Observability
Testing
Testing Method Security
Testing Web Security
WebTestClient Setup
Testing Authentication
Testing CSRF
Testing OAuth 2.0
Testing X509
WebFlux Security
GraalVM Native Image Support
Method Security
Search
Edit this Page
GitHub Project
Stack Overflow
Spring Security
GraalVM Native Image Support
Method Security
This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 7.1.0!
Method Security in GraalVM Native Image
Although Method Security is supported in GraalVM Native Image, there are some use cases that need additional hints provided by the application.
Using @PreAuthorize and @PostAuthorize Annotations
Using @PreAuthorize and @PostAuthorize annotations require additional hints if you have a custom implementation of UserDetails or Authentication classes.
Let’s take an example where you have a custom implementation of UserDetails class as follows and that implementation is returned by your UserDetailsService:
Custom Implementation of UserDetails
public class CustomUserDetails implements UserDetails {
private final String username;
private final String password;
private final Collection<? extends GrantedAuthority> authorities;
public boolean isAdmin() {
return this.authorities.contains(new SimpleGrantedAuthority("ROLE_ADMIN"));
}
// constructors, getters and setters
}
And you want to use the isAdmin() method inside a @PreAuthorize annotation as follows:
Using isAdmin() to secure a method
@PreAuthorize("principal?.isAdmin()")
public String hello() {
return "Hello!";
}
Remember that you need to add @EnableMethodSecurity annotation to your configuration class to enable method security annotations.
If you run the native image of your application with the above configuration, you will get an error similar to the following when trying to invoke the hello() method:
failed: java.lang.IllegalArgumentException: Failed to evaluate expression 'principal?.isAdmin()' with root cause
org.springframework.expression.spel.SpelEvaluationException: EL1004E: Method call: Method isAdmin() cannot be found on type com.mypackage.CustomUserDetails
Which means that the isAdmin() method cannot be found on the CustomUserDetails class.
This is because Spring Security uses reflection to invoke the isAdmin() method and GraalVM Native Image does not support reflection by default.
To fix this issue, you need to give hints to GraalVM Native Image to allow reflection on the CustomUserDetails#isAdmin() method.
We can do that by providing a custom hint.
In this example we are going to use the @RegisterReflectionForBinding annotation.
You might need to register all your classes that you want to use in your @PreAuthorize and @PostAuthorize annotations.
Using @RegisterReflectionForBinding
@Configuration
@RegisterReflectionForBinding(CustomUserDetails.class)
public class MyConfiguration {
//...
}
And that’s it, now you can run the native image of your application and it should work as expected.
Spring Security
Stable
7.1.0
7.0.6
6.5.11
Snapshot
7.1.1-SNAPSHOT
7.0.7-SNAPSHOT
6.5.12-SNAPSHOT
Related Spring Documentation
Spring Framework
Spring Security
Spring Authorization Server
Spring LDAP
Spring Security Kerberos
Spring Session
Spring Vault
Spring GraphQL
All Docs...
Copyright © 2005 -
Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
Terms of Use • Privacy • Trademark Guidelines • Thank you • Your California Privacy Rights • Cookie Settings
Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java™, Java™ SE, Java™ EE, and OpenJDK™ are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners.
Search in all Spring Docs