How to create custom methods for use in spring security expression language annotations

Question

I would like to create a class that adds custom methods for use in spring security expression language for method-based authorization via annotations.

For example, I would like to create a custom method like 'customMethodReturningBoolean' to be used somehow like this:

  @PreAuthorize("customMethodReturningBoolean()")   public void myMethodToSecure() {      // whatever   } 

My question is this. If it is possible, what class should I subclass to create my custom methods, how would I go about configuring it in the spring xml configuration files and come someone give me an example of a custom method used in this way?

Answer 1

None of the mentioned techniques will work anymore. It seems as though Spring has gone through great lengths to prevent users from overriding the SecurityExpressionRoot.

EDIT 11/19/14 Setup Spring to use security annotations:

<beans ... xmlns:sec="http://www.springframework.org/schema/security" ... > ... <sec:global-method-security pre-post-annotations="enabled" /> 

Create a bean like this:

@Component("mySecurityService") public class MySecurityService {     public boolean hasPermission(String key) {         return true;     } } 

Then do something like this in your jsp:

<sec:authorize access="@mySecurityService.hasPermission('special')">     <input type="button" value="Special Button" /> </sec:authorize> 

Or annotate a method:

@PreAuthorize("@mySecurityService.hasPermission('special')") public void doSpecialStuff() { ... } 

Additionally, you may use Spring Expression Language in your @PreAuthorize annotations to access the current authentication as well as method arguments.

For example:

@Component("mySecurityService") public class MySecurityService {     public boolean hasPermission(Authentication authentication, String foo) { ... } } 

Then update your @PreAuthorize to match the new method signature:

@PreAuthorize("@mySecurityService.hasPermission(authentication, #foo)") public void doSpecialStuff(String foo) { ... }