blocks|key|842989|text|您需要创建两个类的子类。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|842990|首先，设置一个新的方法表达式处理程序|842991|<global-method-security>
++<expression-handler+ref="myMethodSecurityExpressionHandler"/>
</global-method-security>|code-block|syntax|javascript|842992|myMethodSecurityExpressionHandler将是覆盖createEvaluationContext()的DefaultMethodSecurityExpressionHandler的子类，在MethodSecurityEvaluationContext上设置MethodSecurityExpressionRoot的子类。|offset|length|style|CODE|842993|例如：|842994|@Override
public+EvaluationContext+createEvaluationContext(Authentication+auth,+MethodInvocation+mi)+{
++++MethodSecurityEvaluationContext+ctx+=+new+MethodSecurityEvaluationContext(auth,+mi,+parameterNameDiscoverer);
++++MethodSecurityExpressionRoot+root+=+new+MyMethodSecurityExpressionRoot(auth);
++++root.setTrustResolver(trustResolver);
++++root.setPermissionEvaluator(permissionEvaluator);
++++root.setRoleHierarchy(roleHierarchy);
++++ctx.setRootObject(root);

++++return+ctx;
}|842995|entityMap^0|0|0|0|0|X|11|P|1R|12|2Y|V|3W|S|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|X|8|@$K|Y|L|Z|M|N]|$K|10|L|11|M|N]|$K|12|L|13|M|N]|$K|14|L|15|M|N]|$K|16|L|17|M|N]]|9|@]|A|$]]|$1|O|3|P|5|6|7|18|8|@]|9|@]|A|$]]|$1|Q|3|R|5|F|7|19|8|@]|9|@]|A|$G|H]]|$1|S|3|-4|5|6|7|1A|8|@]|9|@]|A|$]]]|T|$]]

You'll need to subclass two classes.

First, set a new method expression handler

<pre><code>&lt;global-method-security&gt;
 &lt;expression-handler ref="myMethodSecurityExpressionHandler"/&gt;
&lt;/global-method-security&gt;
</code></pre>

<code>myMethodSecurityExpressionHandler</code> will be a subclass of <code>DefaultMethodSecurityExpressionHandler</code> which overrides <code>createEvaluationContext()</code>, setting a subclass of <code>MethodSecurityExpressionRoot</code> on the <code>MethodSecurityEvaluationContext</code>.

For example:

<pre><code>@Override
public EvaluationContext createEvaluationContext(Authentication auth, MethodInvocation mi) {
 MethodSecurityEvaluationContext ctx = new MethodSecurityEvaluationContext(auth, mi, parameterNameDiscoverer);
 MethodSecurityExpressionRoot root = new MyMethodSecurityExpressionRoot(auth);
 root.setTrustResolver(trustResolver);
 root.setPermissionEvaluator(permissionEvaluator);
 root.setRoleHierarchy(roleHierarchy);
 ctx.setRootObject(root);

 return ctx;
}
</code></pre>

blocks|key|843102|text|上面提到的这些技术都不再有效。看起来Spring似乎已经花了很长时间来阻止用户覆盖SecurityExpressionRoot。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|843103|编辑14年11月19日Setup+Spring以使用安全注释：|843104|<beans+...+xmlns:sec="http://www.springframework.org/schema/security"+...+>
...
<sec:global-method-security+pre-post-annotations="enabled"+/>|code-block|syntax|javascript|843105|创建一个bean，如下所示：|843106|@Component("mySecurityService")
public+class+MySecurityService+{
++++public+boolean+hasPermission(String+key)+{
++++++++return+true;
++++}
}|843107|然后在您的jsp中执行如下操作：|843108|<sec:authorize+access="@mySecurityService.hasPermission('special')">
++++<input+type="button"+value="Special+Button"+/>
</sec:authorize>|843109|或者注释一个方法：|843110|@PreAuthorize("@mySecurityService.hasPermission('special')")
public+void+doSpecialStuff()+{+...+}|843111|此外，您可以在@PreAuthorize注释中使用Spring+Expression+Language来访问当前的身份验证和方法参数。|offset|length|style|CODE|843112|例如：|843113|@Component("mySecurityService")
public+class+MySecurityService+{
++++public+boolean+hasPermission(Authentication+authentication,+String+foo)+{+...+}
}|843114|然后更新您的@PreAuthorize以匹配新的方法签名：|843115|@PreAuthorize("@mySecurityService.hasPermission(authentication,+#foo)")
public+void+doSpecialStuff(String+foo)+{+...+}|843116|entityMap|0|LINK|mutability|MUTABLE|url|http://docs.spring.io/spring/docs/current/spring-framework-reference/html/expressions.html^0|0|0|0|0|0|0|0|0|0|7|D|P|Q|0|0|0|0|6|D|0|0^^$0|@$1|2|3|4|5|6|7|1G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1H|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|1I|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|1J|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|1K|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|1L|8|@]|9|@]|A|$]]|$1|O|3|P|5|F|7|1M|8|@]|9|@]|A|$G|H]]|$1|Q|3|R|5|6|7|1N|8|@]|9|@]|A|$]]|$1|S|3|T|5|F|7|1O|8|@]|9|@]|A|$G|H]]|$1|U|3|V|5|6|7|1P|8|@$W|1Q|X|1R|Y|Z]]|9|@$W|1S|X|1T|1|1U]]|A|$]]|$1|10|3|11|5|6|7|1V|8|@]|9|@]|A|$]]|$1|12|3|13|5|F|7|1W|8|@]|9|@]|A|$G|H]]|$1|14|3|15|5|6|7|1X|8|@$W|1Y|X|1Z|Y|Z]]|9|@]|A|$]]|$1|16|3|17|5|F|7|20|8|@]|9|@]|A|$G|H]]|$1|18|3|-4|5|6|7|21|8|@]|9|@]|A|$]]]|19|$1A|$5|1B|1C|1D|A|$1E|1F]]]]

None of the mentioned techniques will work anymore. It seems as though Spring has gone through great lengths to prevent users from overriding the SecurityExpressionRoot.

EDIT 11/19/14 Setup Spring to use security annotations:

<pre><code>&lt;beans ... xmlns:sec="http://www.springframework.org/schema/security" ... &gt;
...
&lt;sec:global-method-security pre-post-annotations="enabled" /&gt;
</code></pre>

Create a bean like this:

<pre><code>@Component("mySecurityService")
public class MySecurityService {
 public boolean hasPermission(String key) {
 return true;
 }
}
</code></pre>

Then do something like this in your jsp:

<pre><code>&lt;sec:authorize access="@mySecurityService.hasPermission('special')"&gt;
 &lt;input type="button" value="Special Button" /&gt;
&lt;/sec:authorize&gt;
</code></pre>

Or annotate a method:

<pre><code>@PreAuthorize("@mySecurityService.hasPermission('special')")
public void doSpecialStuff() { ... }
</code></pre>

Additionally, you may use <a href="http://docs.spring.io/spring/docs/current/spring-framework-reference/html/expressions.html" rel="noreferrer">Spring Expression Language</a> in your <code>@PreAuthorize</code> annotations to access the current authentication as well as method arguments.

For example:

<pre><code>@Component("mySecurityService")
public class MySecurityService {
 public boolean hasPermission(Authentication authentication, String foo) { ... }
}
</code></pre>

Then update your <code>@PreAuthorize</code> to match the new method signature:

<pre><code>@PreAuthorize("@mySecurityService.hasPermission(authentication, #foo)")
public void doSpecialStuff(String foo) { ... }
</code></pre>

I would like to create a class that adds custom methods for use in spring security expression language for method-based authorization via annotations.

For example, I would like to create a custom method like 'customMethodReturningBoolean' to be used somehow like this:

<pre><code> @PreAuthorize("customMethodReturningBoolean()")
 public void myMethodToSecure() { 
 // whatever
 }
</code></pre>

My question is this.
If it is possible, what class should I subclass to create my custom methods, how would I go about configuring it in the spring xml configuration files and come someone give me an example of a custom method used in this way?

How to create custom methods for use in spring security expression language annotations

身份验证

我想创建一个类来添加自定义方法，以便在spring安全表达式语言中通过注释进行基于方法的授权。例如，我想创建一个像'customMethodReturningBoolean‘这样的自定义方法，以便以某种方式使用：  @PreAuthorize("customMethodReturningBoolean()")  pub...

问如何创建在spring安全表达式语言批注中使用的自定义方法
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何创建在spring安全表达式语言批注中使用的自定义方法EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何创建在spring安全表达式语言批注中使用的自定义方法
EN