Spring security - write custom SPEL access expression. Is my approach correct?

I want to specify an intercept-url pattern for example pattern = hasCollege('college1',college2')

. For this I think about the following:

a) Configure WebExpressionVoter

to use a custom expression handler

<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:property name="decisionVoters">
        <beans:list>
            <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                <beans:property name="expressionHandler" ref="myWebSecurityExpressionHandler"/>
            </beans:bean>
        </beans:list>
    </beans:property>
</beans:bean>
<beans:bean id="myWebSecurityExpressionHandler" class="com.daud.security.EEWebSecurityExpressionHandler"/>

      

b) Inject the EEWebSecurityExpressionHandler

implementation WebSecurityExpressionHandler

in order DefaultWebSecurityExpressionHandler

and use createEvaluationContext

to set the custom root object.

@Override
    public EvaluationContext createEvaluationContext(Authentication authentication, FilterInvocation fi) {
        StandardEvaluationContext ctx = new StandardEvaluationContext();
        SecurityExpressionRoot root = new MyWebSecurityExpressionRoot(authentication, fi);
        root.setTrustResolver(trustResolver);
        root.setRoleHierarchy(roleHierarchy);
        ctx.setRootObject(root);
        return ctx;
    }

      

c) Do MyWebSecurityExpressionRoot

extend WebSecurityExpressionRoot

and declare a new method corresponding to the new SPEL expression:

public final boolean hasCollege(String... colleges){
       // logic goes here
    }

      

Does this approach the problem correctly?

+3


source to share


1 answer


In your spring security configuration, you can simply do the following.

<http use-expressions="true">
    <intercept-url pattern="/**" access="isFullyAuthenticated() and principal.college matches 'Duke|USC'"/>

      



This assumes you have a getCollege () method on your site.

+1


source







All Articles