A short two months back I posted an article describing how to upgrade to Spring 3.0 M2. Spring folks are releasing at breakneck speed and so I got busy again upgrading spincloud.com to Spring 3.0 M3 released at the beginning of May. Just yesterday (June 3rd) the team released Spring Security 3.0 M1 and I decided to roll this in Spincloud as well.

Upgrading Spring Security from 2.0.4 to 3.0.0 M1
For Spring Security 3.0.0 M1 I’m doing a “soft” upgrade since I had done my homework when I migrated from Acegi. I won’t use any of the new 3.0 features, just getting ready to use them.

To digress a bit, Spring Security a technology that is harder to swallow due to its breadth. To simplify the picture, Spring Security (former Acegi) provides three major security concerns to enterprise applications:
- Authorization of method execution (either through standard JSR-250 JEE security annotations or via specific annotation-based method security).
- HTTP Request authorization (mapping URLs to accessible roles using Ant style or regexp’ed paths, dubbed channel security).
- Website authentication (integrating Single Sign On (SSO) services by supporting major SSO providers, HTTP BASIC authentication, OpenId authentication and other types).
For Spincloud I’m using OpenId for authentication and Channel Security to secure website pages.

To perform the upgrade you have to first grab the new jars. Here’s the Maven config:

	<repository>
		<id>Springframework milestone</id>
		<url>http://maven.springframework.org/milestone</url>
	</repository>
	<properties>
		<spring.version>3.0.0.M3</spring.version>
		<spring-security.version>3.0.0.M1</spring-security.version>
	</properties>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-core</artifactId>
			<version>${spring-security.version}</version>
			<scope>compile</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
			<version>${spring-security.version}</version>
			<scope>compile</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-openid</artifactId>
			<version>${spring-security.version}</version>
			<scope>compile</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-taglibs</artifactId>
			<version>${spring-security.version}</version>
			<scope>compile</scope>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-web</artifactId>
			<version>${spring-security.version}</version>
			<scope>compile</scope>
		</dependency>

Make sure your build process refers only to these jars.
in 3.0.0 M1, the package structure was changed. Here’s what I had to do to upgrade the packages:
Before

import org.springframework.security.Authentication;
import org.springframework.security.context.SecurityContext;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.context.SecurityContextImpl;
import org.springframework.security.providers.openid.OpenIDAuthenticationStatus;
import org.springframework.security.providers.openid.OpenIDAuthenticationToken;
import org.springframework.security.userdetails.UserDetails;
import org.springframework.security.userdetails.UserDetailsService;

After:

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextImpl;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.openid.OpenIDAuthenticationStatus;
import org.springframework.security.openid.OpenIDAuthenticationToken;

The security namespace has changed too so I updated my security XML file namespace and I had only to change the packages for standard Spring Security beans defined to match the new package structure.

Upgrading Spring from 3.0.0 M2 to M3
This should be easy. First, grab the new jars through Maven by using the same Maven config I described at the beginning of this post and change the spring.version to 3.0.0.M3. I’m planning to move more XML configuration to annotations and M3 enables more of that (@Lazy for instance). I’m still waiting for the scheduling namespace due to appear in this milestone but pushed to RC1 apparently. I’m craving for some annotation-based timer configuration too…

Build and deployment
At first, the build failed on me with the follwing error:

java.lang.NoClassDefFoundError: org/springframework/asm/ClassVisitor
	at org.springframework.context.support.AbstractRefreshableApplicationContext.customizeBeanFactory(AbstractRefreshableApplicationContext.java:205)
	at org.springframework.context.support.AbstractRefreshableApplicationContext.refreshBeanFactory(AbstractRefreshableApplicationContext.java:125)
	at org.springframework.context.support.AbstractApplicationContext.obtainFreshBeanFactory(AbstractApplicationContext.java:419)

This is because M3 (finally) repackages asm. So I deleted the asm libraries I used to fix the M2 issues and added the repackaged Spring asm library:

		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>org.springframework.asm</artifactId>
			<version>${spring.version}</version>
		</dependency>

If you’re getting this error on container start-up:

SEVERE: Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Unable to locate Spring NamespaceHandler for XML schema namespace [http://www.springframework.org/schema/security]
Offending resource: ServletContext resource [/WEB-INF/classes/applicationContext-security.xml]

means you have forgotten to add security-config jar (see the Maven config in the Security section).

That’s all. Done in 3 hours with no problems at all.

<repository>
  <id>SpringSource Enterprise Bundle Repositorys</id>
  <url>http://repository.springsource.com/maven/bundles/milestone</url>
</repository>

and the spring packages that you need since the packaging has changed from 2.5.x. Instead of a single spring.jar file, now there is one per feature so you have to sort out what jars to include in the project. I ended up with the following:

  <properties>
      <spring.version>3.0.0.M2</spring.version>
  </properties>
  <dependencies>
   ...
  <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.core</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.web</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.transaction</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.orm</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.jdbc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.web.servlet</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.context</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.aop</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.expression</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>org.springframework.test</artifactId>
      <version>${spring.version}</version>
    </dependency>
  </dependencies>

Once the jars are brought, I’ve replaced my old jarfiles with the all-new M2s then fired the build target.
The first issue I found was with the asm version.

Spring 2.5 uses a repackaged asm version 2.2.3 (more info here). The new Spring 3.0 M2 doesn’t package it anymore ( see comment) so I had to add it manually. I had to add the two asm 2.2.3 jars in order to resolve this dependency:

   <dependency>
     <groupId>asm</groupId>
     <artifactId>asm-commons</artifactId>
     <version>2.2.3</version>
   </dependency>
   <dependency>
     <groupId>asm</groupId>
     <artifactId>asm</artifactId>
     <version>2.2.3</version>
   </dependency>

After refreshing the jars and redeployed, I hit the first roadblock, a ClassNoDefFoundError:

Initialization of bean failed; nested exception is
java.lang.NoClassDefFoundError: Could not initialize class
net.sf.cglib.proxy.Enhancer
...
Caused by: java.lang.ClassNotFoundException:
org.objectweb.asm.CodeVisitor

Odd, I didn’t have this error before but as it turns out, I was using a cglib version 2.1.3 which has a hard dependency on asm and I actually had an asm jar version 1.5.3 packaged along with the other jar dependencies. On top of this, there is a problem with an antlr version conflict. Different versions of antlr are required by Spring 3.0 and Hibernate 3.3.1 which I’m also using. This is Jar hell! So I put together a version requirment matrix to sort-out the dependencies between these libraries:

Fortunately the Hibernate folks have changed the default bytecode generation library to javassist starting with v3.2.2. The bummer is the cglib dependency on asm 1.5.3 since this version is in conflict with asm 2.2.3 required by both Spring and Hibernate. The solution is to use a repackaged cglib as explained here.
To get the nodep version of cglib, I added the following snippet in my pom.xml file:

<dependency>
  <groupId>cglib</groupId>
  <artifactId>cglib-nodep</artifactId>
  <version>2.2</version>
</dependency>

I’m taking the opportunity and upgrade to the newer version 2.2 of cglib.
Next is antlr. Spring requires a different version of antlr than Hibernate but fortunately antlr has changed the package notation from antlr.* in v2.x to org.antlr.* in v3.x so it’s safe to include both jars. Let’s get both versions through Maven:

   <dependency>
     <groupId>antlr</groupId>
     <artifactId>antlr</artifactId>
     <version>2.7.7</version>
   </dependency>
   <dependency>
     <groupId>org.antlr</groupId>
     <artifactId>antlr</artifactId>
     <version>3.0.1</version>
   </dependency>

Here’s the mix of jars that works for me with Spring & Hibernate:

I can’t help but notice the compatibility problems with using the Spring & Hibernate mix. It wasn’t easy to fix them and it still feels more of a hack than an actual solution. In Spring’s defense, this is a milestone version so I should expect some wrinkles. I had similar issues when upgrading Hibernate a while back. Hibernate was the first to change their packaging to use feature-centric jars (I think). I recall having issues around antlr and asm. I remember being reluctant at first about the new dependency to javassist but it worked just fine.

Next on the list is refactoring the controllers to use the new REST support of Spring. The majority of my controllers are extending from org.springframework.web.servlet.mvc.AbstractController so I’ll upgrade them to use @Controller stereotype. I’m already familiar with @Controller, I’m using it to route all top URLs found on Spincloud’s header (i.e. features). I use a simple approach: drop the inheritance to AbstractController and change handleRequestInternal:

@Controller
public class WeatherDetailsController extends AbstractController {
...
  @Override
   protected ModelAndView handleRequestInternal(HttpServletRequest request,
     HttpServletResponse response) throws Exception {
    //parse URI to extract stationIDs
...
  }
}

with the much cooler:

@Controller
public class WeatherDetailsController {
...
 @RequestMapping(value="/weather/{stationIds}", method = RequestMethod.GET)
 public ModelAndView displayWeather(@PathVariable("stationIds") String idz,
   HttpServletRequest request, HttpServletResponse response) {
...
  }
}

Last, remove the carbonfive HandlerMapping bean in the spring servlet XML which used to look like this:

 <bean class="carbonfive.spring.web.pathparameter.ParameterizedUrlHandlerMapping">
  <property name="alwaysUseFullPath" value="true"/>
  <property name="mappings">
   <props>
    <prop key="/weather/*">weatherDetailsController</prop>
   </props>
  </property>
 </bean>

Deployed and started the container successfully but when I hit a URL that was supposed to be routed through the new controller, I got the following error:

2009-03-07 20:55:49,072: WARN  PageNotFound:1017
 No mapping found for HTTP request with URI [/weather/15150] in
DispatcherServlet with name 'weather'

Bummer: the URL is not routed to any controller. I initially suspected the DefaultAnnotationHandlerMapping I was using was to blame but after searching on the interweb and finding nothing else worthy and a couple of hours of research in my own code, I discovered that the problem was in web.xml. I had fine grained servlet-mapping URLs, including one that should have routed all URLs starting with /weather that looked like this:

 <servlet-mapping>
   <servlet-name>weather</servlet-name>
   <url-pattern>/weather/*</url-pattern>
 </servlet-mapping>

which is not good anymore. After checking the web.xml file in the Petstore example, I noticed that the servlet mappings can use the greedy <url-pattern>/</url-pattern> to route to one controller then more specific patterns for routing to other controllers. Since I have more than one controller, I changed the mappings like below:

 <servlet-mapping>
   <servlet-name>weather</servlet-name>
   <url-pattern>/</url-pattern>
 </servlet-mapping>
 <servlet-mapping>
   <servlet-name>tag</servlet-name>
   <url-pattern>/tag/*</url-pattern>
 </servlet-mapping>