Spring Security使用PreAuthorize中的hasPermission仅使用一个参数

Question

How can I call the hasPermission function with just one parameter?

Currently I have something like this:

@PreAuthorize("hasPermission('someResource', 'READ')")

I want to be able to do this:

@PreAuthorize("hasPermission('canReadSomeResource')")

Is there an easy way to accomplish this? I basically just want to specify the permission that is needed in order to call a method, rather than a resource and a permission.

Answer 1

The specific purpose of hasPermission() is to check whether a user is authorized to execute an operation on a particular domain object. If you're wanting to just check whether a user has a certain general-purpose authority, you should use hasRole() .

Answer 2

I think you need hasAuthority('canReadSomeResource') that checks the user authority to access a resource.

@PreAuthorize("hasAuthority('canReadSomeResource')")
public void myMethod(){
   ...
}

That authority ( canReadSomeResource ) can be provided to the spring security by implementing UserDetailsService interface.