在Spring Security中将XML配置转换为Java配置以实现全局方法安全

Question

I am trying to convert xml configuration to java config

My XML configuration like this

<security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" access-decision-manager-ref="methodAccessDecisionManager">
        <security:expression-handler ref="methodExpressionHandler"/>
</security:global-method-security>

I am tried to convert with annotation

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)

But I am not getting how I can convert and use with global security method access-decision-manager-ref="methodAccessDecisionManager" and <security:expression-handler ref="methodExpressionHandler"/>

Answer 1

You could write a custom method security configruation, see Spring Security Reference :

5.10.2 GlobalMethodSecurityConfiguration

Sometimes you may need to perform operations that are more complicated than are possible with the @EnableGlobalMethodSecurity annotation allow. For these instances, you can extend the GlobalMethodSecurityConfiguration ensuring that the @EnableGlobalMethodSecurity annotation is present on your subclass. For example, if you wanted to provide a custom MethodSecurityExpressionHandler , you could use the following configuration:

 @EnableGlobalMethodSecurity(prePostEnabled = true) public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration { @Override protected MethodSecurityExpressionHandler createExpressionHandler() { // ... create and return custom MethodSecurityExpressionHandler ... return expressionHandler; } } 

For additional information about methods that can be overridden, refer to the GlobalMethodSecurityConfiguration Javadoc.

Your modified code:

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

    @Autowired
    private AccessDecisionManager accessDecisionManager;

    @Autowired
    private MethodSecurityExpressionHandler methodSecurityExpressionHandler;

    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return methodSecurityExpressionHandler;
    }

    protected AccessDecisionManager accessDecisionManager() {
        return accessDecisionManager;
    }
}