Spring Security #PreAuthorize annotation with AuthenticationSuccessEvent - spring

Question

I have basic authentication and i want to log/do something on succesfull log in but AuthenticationSuccessEvent is firing up even if that ROLE dont have permission i need to access that HTTP method. How can i log/do something ONLY if i can access that HTTP method with permission.
#Component("authorization")
public class AuthorizationUtils {
public boolean hasPermission(final String permission) {
Collection<? extends GrantedAuthority> authorities = getUserDetails().getAuthorities();
return authorities.contains(new SimpleGrantedAuthority(permission));
}
public static UserDetails getUserDetails() {
SecurityContext securityContext = SecurityContextHolder.getContext();
Authentication authentication = securityContext.getAuthentication();
if (authentication != null && authentication.getPrincipal() instanceof UserDetails) {
return (UserDetails) authentication.getPrincipal();
}
return null;
}
}
public class AuthenticationEventListener implements ApplicationListener<AuthenticationSuccessEvent> {
#Autowired
private HttpServletRequest request;
#Override
public void onApplicationEvent(AuthenticationSuccessEvent event) {
String username = ((UserAccountDetails) event.getAuthentication().getPrincipal()).getUsername();
log.trace("Account with username : {} successfully log in!", username);
System.out.println(request.getHeader("Authorization"));
}
#GetMapping("/permission")
#PreAuthorize("#authorization.hasPermission('edit.helloworld123')")
public String editHelloWorld(){
return "Welcome to permission edit.helloWorld!";
}

Answer 1

Authorization is not the same as Authentication .Authentication is about whether an user can login successfully or not. Authorization is about if the login user have enough permission to execute a method. So even an user is successfully login (i.e AuthenticationSuccessEvent happens) , if he does not have enough permission to execute a method, the method still fail to execute.
What you are really want is to detect the authorization success event , but you are now detecting the authentication success event , which are totally different things.
To enable spring-security to publish the authorization success event after an user who has enough permission execute a protected method successfully , you have to enable setPublishAuthorizationSuccess of the MethodInterceptor.
From the docs to override the default settings related to method security, you can extend GlobalMethodSecurityConfiguration :
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
#Override
public MethodInterceptor methodSecurityInterceptor(MethodSecurityMetadataSource methodSecurityMetadataSource) {
MethodInterceptor result = super.methodSecurityInterceptor(methodSecurityMetadataSource);
((MethodSecurityInterceptor) result).setPublishAuthorizationSuccess(true);
return result;
}
}
And AuthorizedEvent will be published after the user has enough permission to execute a protected method .So create a ApplicationListener to listen and handle it :
#Component
public class MyEventListener implements ApplicationListener<AuthorizedEvent> {
#Override
public void onApplicationEvent(AuthorizedEvent event) {
//Handle the AuthorizedEvent event here......
}
}