Spring Security and AOP issue <p>I am adding AOP feature on a Spring-Security application deployed on a Tomcat 7 server. The application worked fine since I added the AspectJ dependency.</p> <p>This is my Maven dependencies in my POM:</p> <pre><code>&lt;properties&gt; &lt;spring.framework.version&gt;4.0.5.RELEASE&lt;/spring.framework.version&gt; &lt;spring.security.version&gt;3.2.4.RELEASE&lt;/spring.security.version&gt; &lt;/properties&gt; &lt;!-- Spring dependencies --&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-core&lt;/artifactId&gt; &lt;version&gt;${spring.framework.version}&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-context&lt;/artifactId&gt; &lt;version&gt;${spring.framework.version}&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-tx&lt;/artifactId&gt; &lt;version&gt;${spring.framework.version}&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-jdbc&lt;/artifactId&gt; &lt;version&gt;${spring.framework.version}&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework.security&lt;/groupId&gt; &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt; &lt;version&gt;${spring.security.version}&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-aop&lt;/artifactId&gt; &lt;version&gt;${spring.framework.version}&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.aspectj&lt;/groupId&gt; &lt;artifactId&gt;aspectjtools&lt;/artifactId&gt; &lt;version&gt;1.8.1&lt;/version&gt; &lt;/dependency&gt; &lt;/dependencies&gt; </code></pre> <p>And here, my Spring configuration (at least, the most relevant):</p> <pre><code>&lt;security:global-method-security secured-annotations="enabled" /&gt; &lt;bean id="myAuthenticationDetailsSource" class="net.classnotfound.MyAuthenticationDetailsSource"&gt; &lt;/bean&gt; &lt;bean id="oracleLoginChecker" class="net.classnotfound.OracleLoginChecker"&gt; &lt;/bean&gt; &lt;bean id="ldapLoginChecker" class="net.classnotfound.LdapLoginChecker"&gt; &lt;/bean&gt; &lt;bean id="myAuthenticationProvider" class="net.classnotfound.MyAuthenticationProvider"&gt; &lt;property name="loginCheckerMap"&gt; &lt;map&gt; &lt;entry key="ORACLE" value-ref="oracleLoginChecker"/&gt; &lt;entry key="LDAP" value-ref="ldapLoginChecker"/&gt; &lt;/map&gt; &lt;/property&gt; &lt;/bean&gt; &lt;bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener" /&gt; &lt;security:authentication-manager alias="authenticationManager"&gt; &lt;!-- create a custom AuthenticationProvider class to tune the login process --&gt; &lt;security:authentication-provider ref="myAuthenticationProvider" /&gt; &lt;/security:authentication-manager&gt; &lt;security:http auto-config="true" use-expressions="true"&gt; &lt;security:intercept-url pattern="/faces/login/**" access="anonymous" /&gt; &lt;security:intercept-url pattern="/faces/**" access="authenticated" /&gt; &lt;security:form-login login-page="/faces/login/login.xhtml" authentication-failure-url="/faces/login/login.xhtml?error=1" default-target-url="/faces/index.xhtml" authentication-details-source-ref="myAuthenticationDetailsSource" username-parameter="username" password-parameter="password" /&gt; &lt;/security:http&gt; &lt;tx:annotation-driven /&gt; &lt;beans&gt; &lt;bean id="aroundAspect" class="net.classnotfound.AroundAdvice" /&gt; &lt;aop:aspectj-autoproxy /&gt; &lt;aop:config&gt; &lt;aop:aspect ref="aroundAspect"&gt; &lt;aop:pointcut id="aroundPointCut" expression="@target(org.springframework.transaction.annotation.Transactional)" /&gt; &lt;aop:around pointcut-ref="aroundPointCut" method="doBasicProfiling" /&gt; &lt;/aop:aspect&gt; &lt;/aop:config&gt; &lt;/beans&gt; </code></pre> <p>And now, when I start Tomcat, I have this error:</p> <pre><code>[...] Caused by: java.lang.NoSuchMethodException: com.sun.proxy.$Proxy34.isEraseCredentialsAfterAuthentication() at java.lang.Class.getMethod(Class.java:1655) at org.springframework.util.MethodInvoker.prepare(MethodInvoker.java:174) at org.springframework.beans.factory.config.MethodInvokingFactoryBean.afterPropertiesSet(MethodInvokingFactoryBean.java:103) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1612) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1549) ... 64 more </code></pre> <p>I googled a bit and it seems that the JDK proxy mechanism cannot "proxy" method which are note defined at the interface level, I tried to adapt my configuration to proxy classes with:</p> <pre><code>&lt;aop:aspectj-autoproxy proxy-target-class="true"/&gt; </code></pre> <p>But now, i have:</p> <pre><code>[...] Caused by: java.lang.IllegalArgumentException: Cannot subclass final class class org.springframework.security.config.method.GlobalMethodSecurityBeanDefinitionParser$AuthenticationManagerDelegator at org.springframework.cglib.proxy.Enhancer.generateClass(Enhancer.java:446) at org.springframework.cglib.transform.TransformingClassGenerator.generateClass(TransformingClassGenerator.java:33) at org.springframework.cglib.core.DefaultGeneratorStrategy.generate(DefaultGeneratorStrategy.java:25) at org.springframework.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:216) at org.springframework.cglib.proxy.Enhancer.createHelper(Enhancer.java:377) at org.springframework.cglib.proxy.Enhancer.createClass(Enhancer.java:317) at org.springframework.aop.framework.ObjenesisCglibAopProxy.createProxyClassAndInstance(ObjenesisCglibAopProxy.java:57) at org.springframework.aop.framework.CglibAopProxy.getProxy(CglibAopProxy.java:202) ... 34 more </code></pre> <p>I guess it's normal because it's a known limitation of AspectJ.</p> <p>So now, i am stuck, do I have to give up the idea to use Spring security and AOP in the same project (weird) or there is some obscure configuration, or some dependencies to use? Thanks for your help.</p>