From 9766ee1cbee71348f2c0c5a8d8186fce818c992e Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Thu, 26 Jan 2006 10:12:09 +0000
Subject: [PATCH] SEC-151: Add comment about BeanNameAutoProxyCreator.

---
 doc/docbook/acegi.xml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/doc/docbook/acegi.xml b/doc/docbook/acegi.xml
index 1ff162fed9..f1d01bf159 100644
--- a/doc/docbook/acegi.xml
+++ b/doc/docbook/acegi.xml
@@ -743,6 +743,26 @@ public interface BankManager {
         Jakarta Commons Attributes method of configuration, you should set
         <literal>validateConfigAttributes</literal> to
         <literal>false</literal>.</para>
+
+        <para>Please note that when using
+        <literal>BeanNameAutoProxyCreator</literal> to create the required
+        proxy for security, the configuration must contain the property
+        <literal>proxyTargetClass</literal> set to <literal>true</literal>.
+        Otherwise, the method passed to
+        <literal>MethodSecurityInterceptor.invoke</literal> is the proxy's
+        caller, not the proxy's target. Note that this introduces a
+        requirement on CGLIB. See an example of using
+        <literal>BeanNameAutoProxyCreator</literal> below:</para>
+
+        <para><programlisting>&lt;bean id="autoProxyCreator" class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator"&gt;
+  &lt;property name="interceptorNames"&gt;
+    &lt;list&gt;&lt;value&gt;methodSecurityInterceptor&lt;/value&gt;&lt;/list&gt;
+  &lt;/property&gt;
+  &lt;property name="beanNames"&gt;
+    &lt;list&gt;&lt;value&gt;targetObjectName&lt;/value&gt;&lt;/list&gt;
+  &lt;/property&gt;
+  &lt;property name="proxyTargetClass" value="true"/&gt;
+&lt;/bean&gt; </programlisting></para>
       </sect2>
 
       <sect2 id="security-interception-aspectj">