SEC-1455: Load namespace parsers when required, rather than on init() call, to avoid classloaded issue with dmServer failing to resolve web classes when the namespace handler is first used.

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -45,6 +45,11 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
         String name = pc.getDelegate().getLocalName(element);
         BeanDefinitionParser parser = parsers.get(name);
 
+        if (parser == null) {
+            // SEC-1455. Load parsers when required, not just on init().
+            loadParsers();
+        }
+
         if (parser == null) {
             if (Elements.HTTP.equals(name) || Elements.FILTER_SECURITY_METADATA_SOURCE.equals(name)) {
                 reportMissingWebClasses(name, pc, element);
@@ -67,6 +72,9 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
             }
 
             if (Elements.FILTER_CHAIN_MAP.equals(name)) {
+                if (filterChainMapBDD == null) {
+                    loadParsers();
+                }
                 if (filterChainMapBDD == null) {
                     reportMissingWebClasses(name, pc, node);
                 }
@@ -91,8 +99,12 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
                 "You need these to use <" + Elements.FILTER_CHAIN_MAP + ">", node);
     }
 
-    @SuppressWarnings("deprecation")
     public void init() {
+        loadParsers();
+    }
+
+    @SuppressWarnings("deprecation")
+    private void loadParsers() {
         // Parsers
         parsers.put(Elements.LDAP_PROVIDER, new LdapProviderBeanDefinitionParser());
         parsers.put(Elements.LDAP_SERVER, new LdapServerBeanDefinitionParser());
@@ -102,7 +114,6 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
         parsers.put(Elements.AUTHENTICATION_PROVIDER, new AuthenticationProviderBeanDefinitionParser());
         parsers.put(Elements.GLOBAL_METHOD_SECURITY, new GlobalMethodSecurityBeanDefinitionParser());
         parsers.put(Elements.AUTHENTICATION_MANAGER, new AuthenticationManagerBeanDefinitionParser());
- //       registerBeanDefinitionDecorator(Elements.INTERCEPT_METHODS, new InterceptMethodsBeanDefinitionDecorator());
 
         // Only load the web-namespace parsers if the web classes are available
         if (ClassUtils.isPresent("org.springframework.security.web.FilterChainProxy", getClass().getClassLoader())) {
@@ -110,7 +121,6 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
             parsers.put(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
             parsers.put(Elements.FILTER_SECURITY_METADATA_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
             filterChainMapBDD = new FilterChainMapBeanDefinitionDecorator();
-            //registerBeanDefinitionDecorator(Elements.FILTER_CHAIN_MAP, new FilterChainMapBeanDefinitionDecorator());
         }
     }