0

I was trying to use the Role Hierarchy feature provided by Spring Security in a Spring Boot application and I found some problems with the java config.

In that application, I've the GlobalMethodSecurity enabled in order to use the @PreAuthorize annotations. Because of that, what I need to do in order to use the Role Hierarchy support is to create a new instance of a DefaultMethodSecurityExpressionHandler and set an instance of a RoleHierarchyImpl instance with the configuration that we want (the role hierarchy itself).

Although, if I try to do this using a WebSecurityConfigurerAdapter and the configure(HttpSecurity http) method, I'm not able to do that because the .expressionHandler() is expecting a SecurityExpressionHandler<FilterInvocation> and the DefaultMethodSecurityExpressionHandler is a SecurityExpressionHandler<MethodInvocation>.

In order to solve this problem, I found out that the solution is to create a subclass of GlobalMethodSecurityConfiguration and override the method that is creating the ExpressionHandler bean like it's described in the docs

GlobalMethodSecurityConfiguration - Spring Security Docs

By saying this, I'm wondering if the .expressionHandler() method shouldn't also allow to do this configuration. If not, maybe a reference in the javadoc pointing to the GlobalMethodSecurityConfiguration would be useful.

After this, I think that the idea of WebSecurityConfigurerAdapter and the .expressionHandler are just applied to the security that is applied based on a Filter of the http request and it isn't supposed to be applied at the method level, but opinions and advices are welcome to confirm that I'm doing as it's supposed.

pVilaca
  • 1,508
  • 1
  • 12
  • 18
  • 1
    You can expose the RoleHierarchyImpl as a Bean and then create the DefaultMethodSecurityExpressionHandler using the RoleHierarchyImpl. Then you can use the RoleHierarchyImpl Bean to create an instance of DefaultWebSecurityExpressionHandler and set that on the expressionHandler(). What we might be able to do is make it so if you expose an instance of RoleHierachy as a Bean we could use it by default. I created https://jira.spring.io/browse/SEC-3189 to make this easier as suggested in the previous sentence – Rob Winch Jan 07 '16 at 03:09
  • That solution sounds very good.. That way, we would just need to expose the RoleHierarchyImpl Bean and the configuration would be done! – pVilaca Jan 07 '16 at 10:43

0 Answers0