自定义权限评估器

Question

I'm trying to override the default permission evaluator in Spring Security 3.0, but no matter what I do, the permission elevator is ignored and the default, DenyAllPermissionEvaluator is invoked instead.

I'm using programmatic configuration, and I've tried setting the permission evaluator by overriding the configure(WebSecurity) and configure(Http) methods of the WebSecurityConfigurerAdapter class, but this doesn't help much.

What is the proper way of setting a custom permission evaluator that will actually be used by Spring Security?

Answer 1

Using xml conf

<security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled">
    <security:expression-handler ref="methodSecurityExpressionHandler"/>
</security:global-method-security>

<bean id="methodSecurityExpressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
       <property name="permissionEvaluator" ref="defaultPermissionEvaluator"/>
    </bean>

and then simply define your bean like normal :

<bean id="defaultPermissionEvaluator" class="com.your.class.implements.permissionevaluator"/>

haven't done with java conf (am I the only person still using xml conf?), but shouldn't be to hard to convert from the above. And make sure you are defining in the correct place, which in most situations is the root context, hwoever we did it in the web context, so as to secure the controllers