spring security, get methods and url from table and validate the authorizeRequests dinamicly - spring

Question

I have this to validate the method and resouce and role but I can not believe that this part need to set in code, exist a way to consult a table?
For example
table: user_access <br>
campos: url , path <br>
method="HttpMethod.GET" <br>
path="/api/clientes/page/**"
And I have this code:
#Configuration
#EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
//implementar reglas de seguridad para los end points
//por el lado de oauth
#Override
public void configure(HttpSecurity http) throws Exception {
//reglas especificate al mas generico
**//I Dont like this part and i try to creat it dinamicly**
http.authorizeRequests().antMatchers(HttpMethod.GET,"/api/clientes","/api/clientes/page/*","/api/clientes/img/*","/images/**").permitAll()
.antMatchers(HttpMethod.GET,"/api/clientes/form/").hasAnyRole("ADMIN","SUPER_ADMIN")
.antMatchers(HttpMethod.POST,"/api/clientes/uploads").hasAnyRole("ADMIN","SUPER_ADMIN")
.antMatchers(HttpMethod.POST,"/api/clientes").hasAnyRole("ADMIN","SUPER_ADMIN")
.antMatchers(HttpMethod.DELETE,"/api/clientes/{id}").hasRole("SUPER_ADMIN")
.antMatchers(HttpMethod.GET,"/api/clientes/{id}").hasRole("SUPER_ADMIN")
.anyRequest().authenticated()
.and().cors().configurationSource(cousConfigurationSource()); //error en el cors con esto se arregla para la pagina de angular
}
//importante no tomar cors.reactive
#Bean
public CorsConfigurationSource cousConfigurationSource() {
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOrigins(Arrays.asList("http://localhost:4200"));
config.setAllowedMethods(Arrays.asList("GET","POST","PUT","DELETE","OPTIONS")); //se podria poner * para todo
config.setAllowCredentials(true);
config.setAllowedHeaders(Arrays.asList("Content-Type","Autorization"));
UrlBasedCorsConfigurationSource source= new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", config);
return source;
}
//filtro //seleccionar spring Framework
#Bean
public FilterRegistrationBean<CorsFilter> corsFilter(){
FilterRegistrationBean<CorsFilter> bean = new FilterRegistrationBean<CorsFilter>(new CorsFilter(cousConfigurationSource()));
bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
return bean;
}
Any Idea to make it more dynamic?

Answer 1

Hope below will help,
You can do it but it will work when the application starts, You can create a table to hold all of required configs, and when the application start running, you can write a code to read all of configured values and use them to configure the HttpSecurity.
Example:
#Entity
public class UserAccessEntity{
#Id
private String url;
private String methodName;
private List<String> userRoles;
private boolean isPattern;
// setter and getter
}
public interface UserAccessRepository extends CrudRepository<UserAccessEntity,String> {}
Then just do the configuration after you fetch the records from the database as below:
#Configuration
#EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {
private final UserAccessRepository repository;
public ResourceServerConfig(UserAccessRepository repository){
this.repository = repository;
}
// Configure this as you need.
#Override
public void configure(HttpSecurity http) throws Exception {
repository.findAll().foreach(userAccess -> {
http.authorizeRequests()
.antMatchers(userAccess.getMethodName(),userAccess.getUrl())
.hasAnyRole(userAccess.getRoles())
});
}
}
Only the limitation you have is that you can pre-configure all of the access before application get started, and you have to restart the server if you need to reflect any change of the user access records.

Answer 2

I think #PreAuthorize can make your validation more dynamically: You can validate for your controller, and using spEL(Spring expression language) to combine more cases.
To enable #PreAuthorize, you need to config in the WebSecurityConfig
#Configuration
#EnableWebSecurity
//enable for #PreAuthorize
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSercurityConfig extends WebSecurityConfigurerAdapter {
//configs
}
In my example, the 'SUPER_ADMIN' or user who owned the resources can access the data from the request(get the user details information). Hope this can be helpful for you.
#RestController
public class UserDetailsController {
#Autowired
private UsersService usersService;
#CrossOrigin(origins = "http://localhost:4200")
#PreAuthorize("hasAuthority('SUPER_ADMIN')" + "or hasAuthority('USER') and authentication.getName().equals(#username)")
#GetMapping(path = "/user/{username}")
public ResponseEntity<?> getUserDetailByUsername(#PathVariable("username") String username, Authentication authentication) {
return ResponseEntity.ok(usersService.getUserByUsername(username));
}
}
spEL references document: Spring Expression Language
, Enable #PreAuthorize reference: Introduction to Spring Method Security