title: Combining @Context and @RolesAllowed in a JAX-RS resource?
body: <p>Is it possible to use <a href="http://docs.oracle.com/javaee/6/api/javax/ws/rs/core/Context.html" rel="nofollow">Context</a> annotation and <a href="https://docs.oracle.com/javaee/6/api/javax/annotation/security/RolesAllowed.html" rel="nofollow">RolesAllowed</a> annotation in a JAX-RS resource with Apache CXF 2.4.6 and Spring Security 3.2.8?</p>
  
  <p>My CXF configuration:</p>
  
  <pre><code>&lt;jaxrs:server address="/example"&gt;
      &lt;jaxrs:serviceBeans&gt;
          &lt;ref bean="myResourceImpl"/&gt;
      &lt;/jaxrs:serviceBeans&gt;
  &lt;/jaxrs:server&gt;
  </code></pre>
  
  <p>My Java source code:</p>
  
  <pre><code>@Path("/myresource")
  public interface MyResource {
  
      @GET
      @Produces(MediaType.TEXT_XML)
      String get();
  }
  
  @Named
  public class MyResourceImpl implements MyResource {
  
      @Context
      private SecurityContext securityContext;
  
      @Override
      @RolesAllowed("ROLE_user")
      public String get() {
          return securityContext.getUserPrincipal().getName();
      }
  }
  </code></pre>
  
  <p>After starting the server, I get following exception:</p>
  
  <pre><code>Caused by: java.lang.IllegalArgumentException: Can not set javax.ws.rs.core.SecurityContext field MyResourceImpl.securityContext to com.sun.proxy.$Proxy473
      at sun.reflect.UnsafeFieldAccessorImpl.throwSetIllegalArgumentException(UnsafeFieldAccessorImpl.java:164)
      at sun.reflect.UnsafeFieldAccessorImpl.throwSetIllegalArgumentException(UnsafeFieldAccessorImpl.java:168)
      at sun.reflect.UnsafeFieldAccessorImpl.ensureObj(UnsafeFieldAccessorImpl.java:55)
      at sun.reflect.UnsafeObjectFieldAccessorImpl.set(UnsafeObjectFieldAccessorImpl.java:75)
      at java.lang.reflect.Field.set(Field.java:741)
      at org.apache.cxf.jaxrs.utils.InjectionUtils$1.run(InjectionUtils.java:164)
      at java.security.AccessController.doPrivileged(Native Method)
      at org.apache.cxf.jaxrs.utils.InjectionUtils.injectFieldValue(InjectionUtils.java:160)
      at org.apache.cxf.jaxrs.utils.InjectionUtils.injectContextProxiesAndApplication(InjectionUtils.java:912)
      at org.apache.cxf.jaxrs.JAXRSServerFactoryBean.injectContexts(JAXRSServerFactoryBean.java:354)
      at org.apache.cxf.jaxrs.JAXRSServerFactoryBean.updateClassResourceProviders(JAXRSServerFactoryBean.java:380)
      at org.apache.cxf.jaxrs.JAXRSServerFactoryBean.create(JAXRSServerFactoryBean.java:145)
      ... 59 more
  </code></pre>
  
  <p>If I remove one of both annotations, it works fine. </p>
  
  <p>The problem seems to be that Spring creates a <a href="http://docs.spring.io/spring/docs/current/spring-framework-reference/html/aop.html#aop-introduction-proxies" rel="nofollow">proxy</a> and Apache CXF cannot inject that proxy with the <a href="https://docs.oracle.com/javaee/6/api/javax/ws/rs/core/SecurityContext.html" rel="nofollow">SecurityContext</a>.</p>
  
  <p>I have to use Spring Security and cannot use <a href="https://docs.oracle.com/javaee/6/tutorial/doc/bnbxe.html" rel="nofollow">container-based security</a>. </p>