The Maven Dependency Dance with Spring Android, Spring Social and Spring Security

Engineering
Josh Long
September 17, 2013

Roy Clarkson (@royclarkson) and I gave a talk at SpringOne2GX 2013 in which we talked about building REST services with an eye towards consuming those services on mobile platforms like Android and iOS. This talk demonstrates the progressive evolution of an application using Spring MVC, Spring HATEOAS, Spring Data REST, Spring Security, Spring Security OAuth, and Spring Android. The code’s benefited from a lot of help from Rob Winch,
Layout of the Code

The code for the talk is on my GitHub account (github.com/joshlong/the-spring-rest-stack). Importantly, the code lives in the code directory. Beneath that there are two choices: web (where you’ll find the rest, hateoas, hateoas-data, and oauth, social modules) and client (where you can load the Android module and the iOS module). The modules in the web folder in respective order, demonstrate the evolution of a simple REST service which incorporates hypermedia, Spring Data repositories and OAuth security. The social module demonstrates how to build an OAuth client that consumes the service.
Building and Editing the Code

The project is all, at the moment, Maven based, though moving to Gradle seems imminent as that is the Google-endorsed route for Android builds. I know the Android client to be importable and buildable using IntelliJ IDEA’s Android support (which in theory should work in Android Studio, which is freely available).
The Dependency Dance and Android

We used up-to-date revisions of major libraries in our build file, linked for reference. Up-to-date and sometimes bleeding edge. The Android application uses the Spring Android project, which - basically - provides an API compatible implementation of the RestTemplate found in Spring core.

It does not however provide the entire framework, and if you bring in certain libraries from the core you’ll get weird issues because some classes in the Spring Android modules are mostly the same in Spring Android and in the core, but they’re not identical, due to the differing natures of the environments in which they run. The easiest way to ensure everything’s OK is to explicitly exclude all Spring modules except the Spring Android dependencies then, selectively, re-introduce the types as you need them.

The types in the Spring Android RestTemplate module provides more than enough compatibility to let Spring Social’s client machinery work unchanged on Android. This, of course, means that we can use the Spring Social-powered OAuth client in the social module in our Android application. Awesome!

For example, while I needed the Spring Social core types and implementations, I didn’t need the core Spring libraries that it brought in. So, we get this rather dramatic stanza:

org.springframework.social spring-social-core ${spring-social.version} org.springframework spring-jdbc com.h2database h2 org.springframework spring-core org.springframework spring-web org.springframework spring-tx org.springframework spring-context org.springframework spring-beans org.springframework spring-expression org.springframework spring-aop aopalliance aopalliance com.joshlong.restfuliterations services

These dependencies can be hard to find. Use the mvn dependency:tree command to see where things are being imported transitively. Spring Security, another library whose top level types we wanted on the CLASSPATH, also required exclusion elements because it drags in Spring core.
Some Classes - like JAXB - You Just Can’t Avoid

Any class that’s not in Android’s JDK-class whitelist is not available on Android and thus renders code that depends on it incompatible. Some classes, like those in the JAXB module, are hard to ignore as they’re pervasive. I wanted to use the Spring HATEOAS Resource, Link, types. These types are used as representations of various entities in REST responses that are sometimes rendered as XML using JAXB, they could not be loaded in Android! So, I had to copy those types locally and mirror the package structure and remove the offending annotations. Hopefully I can clean this up going forward.
comments powered by Disqus

translate：
翻译：

Roy Clarkson（@royclarkson）和我在SpringOne2GX 2013上做了一个演讲，我们讨论了构建REST服务，着眼于在Android和iOS等移动平台上使用这些服务。本文演示了使用Spring MVC、Spring HATEOAS、Spring Data REST、Spring Security、Spring Security OAuth和Spring Android的应用程序的渐进式演进。代码得益于Rob Winch的大量帮助，
代码布局
谈话的代码在我的GitHub帐户上（GitHub.com/joshlong/The spring rest stack）。重要的是，代码位于代码目录中。在这下面有两个选择：web（您可以在其中找到其余的hateoas、hateoas数据和oauth社交模块）和client（您可以在其中加载Android模块和iOS模块）。web文件夹中的各个模块按照各自的顺序展示了一个简单REST服务的发展过程，该服务集成了超媒体、Spring数据存储库和OAuth安全性。social模块演示如何构建使用服务的OAuth客户机。
构建和编辑代码