Combining @Secured and @PreAuthorize annotation on one method

Question

I have the following service method in my application:

    @Override
    @Secured({Authority.ACCESS_FUNDING})
    @PreAuthorize("hasPermission(principal, 'MODIFY')")
    public FundingAllocation newFundingAllocation(FundingAllocationForm fundingAllocationForm) {
      return newFundingAllocation(fundingAllocationForm, null);
    }

But I noticed that the @Secured annotation is getting ignored, and only @PreAuthorize check is performed.

I have the following spring security config:

  <security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled">
    <security:expression-handler ref="securityExpressionHandler"/>
  </security:global-method-security>

Does anybody knows if its even possible to combine to annotations on one method?

Answer 1

As per the Javadoc on DelegatingMethodSecurityMetadataSource it will use the first source of metadata it finds. So it is not intended to mix the two. The rationale is also explained in https://github.com/spring-projects/spring-security/issues/2116

The official docs also state:

You can enable more than one type of annotation in the same application, but only one type should be used for any interface or class as the behaviour will not be well-defined otherwise. If two annotations are found which apply to a particular method, then only one of them will be applied.

So just don't do it and write the correct expression in your @PreAuthorize :

@PreAuthorized("hasAuthority('ACCESS_FUNDING') and hasPermission(principal, 'MODIFY')")

as jmw5598's answer suggests.

Answer 2

With the @PreAuthorize and @PostAuthorize you can combine expressions with and and or operators.

@Override
@PreAuthorized("hasAuthority('ACCESS_FUNDING') and hasPermission(principal, 'MODIFY')")
public FundingAllocation newFundingAllocation(FundingAllocationForm fundingAllocationForm) {
  return newFundingAllocation(fundingAllocationForm, null);
}

Hopefully this is helpful.

http://docs.spring.io/spring-security/site/docs/current/reference/html/el-access.html