Spring security - write custom SPEL access expression. Is my approach correct?
I want to specify an intercept-url pattern for example pattern = hasCollege('college1',college2')
. For this I think about the following:
a) Configure WebExpressionVoter
to use a custom expression handler
<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<beans:property name="decisionVoters">
<beans:list>
<beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
<beans:property name="expressionHandler" ref="myWebSecurityExpressionHandler"/>
</beans:bean>
</beans:list>
</beans:property>
</beans:bean>
<beans:bean id="myWebSecurityExpressionHandler" class="com.daud.security.EEWebSecurityExpressionHandler"/>
b) Inject the EEWebSecurityExpressionHandler
implementation WebSecurityExpressionHandler
in order DefaultWebSecurityExpressionHandler
and use createEvaluationContext
to set the custom root object.
@Override
public EvaluationContext createEvaluationContext(Authentication authentication, FilterInvocation fi) {
StandardEvaluationContext ctx = new StandardEvaluationContext();
SecurityExpressionRoot root = new MyWebSecurityExpressionRoot(authentication, fi);
root.setTrustResolver(trustResolver);
root.setRoleHierarchy(roleHierarchy);
ctx.setRootObject(root);
return ctx;
}
c) Do MyWebSecurityExpressionRoot
extend WebSecurityExpressionRoot
and declare a new method corresponding to the new SPEL expression:
public final boolean hasCollege(String... colleges){
// logic goes here
}
Does this approach the problem correctly?
source to share