Spring security authrorize based on input parameter criteria

Question

I have a scenario where I need to authorize user based on combination of his permission and input parameter passed.

this is the current scenario

public void bookTicket(String bookingType)
    {
    if (bookingType == "AIR"){
         bookAirTicket();
    }else{
         bookBusTicket();
    }
    }


@PreAuthorize("hasRole('BOOK_AIR')")
private void bookAirTicket(){
}

@PreAuthorize("hasRole('BOOK_BUS')")
private void bookBusTicket(){
}

Can we have some thing like

@PreAuthorize(("hasRole('BOOK_AIR')" AND bookinType='AIR') OR ("hasRole('BOOK_BUS')"  AND bookinType='BUS'))
public void bookTicket(String bookingType)
    {
    if (bookingType == "AIR"){
         bookAirTicket();
    }else{
         bookBusTicket();
    }
    }

Basically I need authorization based in input parameters

Thanks

You might read about AccessDecisionVoter to make ConsensusBased decisions. — ipavlic
– ipavlic, Commented Jul 26, 2012 at 7:16

Shaun the Sheep · Accepted Answer · 2012-07-28 12:36:41Z

21

Yes, you can. Parameters can be accessed as Spring EL variables. In fact the reference manual gives several examples which use method parameters. The class needs to be compiled with debug symbols present (which is usually the case).

Note that the annotation value is a single expressions string:

"(hasRole('BOOK_AIR') and #bookinType == 'AIR') or (hasRole('BOOK_BUS') and #bookinType='BUS')"

In practice, using complicated expressions is rather error-prone. You could also use a simpler expression, something like

"@accessChecker.check('book', #bookinType)"

Where accessChecker is a bean in your application context with a "check" method which returns true or false depending on whether the supplied operation information is allowed (you can check the current user's roles by accessing the security context yourself - you'll find that discussed elsewhere on SO).

You could also look into writing your own AccessDecisionManager or AccessDecisionVoter and plugin the functionality there, but that requires more internal knowledge.

answered Jul 28, 2012 at 12:36

Shaun the Sheep

22.9k2 gold badges76 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Anand Rockzz Over a year ago

the advice on how error-prone Spring EL is and how to avoid it, is invaluable. +10 for that! thnx

Guilherme Over a year ago

I was getting an error because my method was void, one hour to see that. Thanks for "method which returns true or false depending"

Collectives™ on Stack Overflow

Spring security authrorize based on input parameter criteria

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related