How to access or grant based on custom conditions - spring

Question

Assume i want to grant an user based on certain conditions not based on roles or permissions or anything.
Assume a user hits the url /getAllOrders. i need to give access if satisfies certain conditions.
In that case, i am not sure how to do it. I checked and come across AccessDecisionVoter and not sure whether it will be suitable for it and also don't know how to implement it.
can someone suggest whethere AccessDecisionVoter would be the right option ?
looking for working sample code snippet which uses AccessDecisionVoter
Thanks.

Answer 1

In your controller you can make use of #PreAuthorize on your handler method and call a method that you declare inside a subclass of SecurityExpressionRoot. You need to do a bit of configuration to register your SecurityExpressionRootinside of a GlobalMethodSecurityConfiguration
In your Controller:
#PreAuthorize("isMyCustomConditionMet()")
#GetMapping("/getAllOrders")
public String allOrders(Model model) {
model.addAttribute("orders", orderService.getAllOrders());
return "orders";
}
In a configuration class:
#Configuration
#EnableGlobalMethodSecurity(prePostEnabled=true)
public class CustomMethodSecurityConfig extends
GlobalMethodSecurityConfiguration {
#Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
return new CustomMethodSecurityExpressionHandler();
}
}
This is the class we are instantiating above:
public class CustomMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler {
#Override
protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, MethodInvocation methodInvocation) {
CustomSecurityExpressionRoot root = new CustomSecurityExpressionRoot(authentication);
root.setThis(methodInvocation.getThis());
root.setPermissionEvaluator(getPermissionEvaluator());
root.setTrustResolver(new AuthenticationTrustResolverImpl());
root.setRoleHierarchy(getRoleHierarchy());
root.setDefaultRolePrefix("ROLE_");
return root;
}
}
This is where you define your customer logic:
public class CustomSecurityExpressionRoot extends SecurityExpressionRoot
implements MethodSecurityExpressionOperations {
private Object filterObject;
private Object returnObject;
private Object target;
public CustomSecurityExpressionRoot(Authentication authentication) {
super(authentication);
}
public boolean isMyCustomConditionMet() {
return [INSERT YOUR LOGIC HERE!];
}
#Override
public void setFilterObject(Object filterObject) {
this.filterObject = filterObject;
}
#Override
public Object getFilterObject() {
return filterObject;
}
#Override
public void setReturnObject(Object returnObject) {
this.returnObject = returnObject;
}
#Override
public Object getReturnObject() {
return returnObject;
}
void setThis(Object target) {
this.target = target;
}
#Override
public Object getThis() {
return target;
}
}