Spring Security-动态禁用安全性

Question

How can I disable Spring Security dynamically? With the code below, my application requires authentication to access some pages, but I'd like to enable / disable that using property files. Any suggestions?

• Spring Security 4

• I know about setting the security attribute to false in the http tag but that requires recompiling code, which is not sufficient for me.

   <sec:http> <sec:intercept-url pattern="/services/**" access="hasRole('ROLE_USER')"/> <sec:intercept-url pattern="/app/**" access="hasRole('ROLE_ADMIN')"/> <sec:intercept-url pattern="/**" access="isAuthenticated()" /> <sec:http-basic /> <sec:csrf disabled="true" /> </sec:http> 

Thanks in advance.

Answer 1

Assuming you have the user and roles being fetched from data base table.Customize some property file so when the server starts up it appropriately updates the db with required roles and the user gets the roles as required.So you can by pass the already existing security.(not exactly by passing but granting the roles based on property file)

Note : you have to write a one time util class to parse the property file and update db which should happen on server start up.