br.com.anteros.security.spring.config

Class AbstractSpringGlobalMethodSecurityConfiguration

java.lang.Object

br.com.anteros.security.spring.config.AbstractSpringGlobalMethodSecurityConfiguration

All Implemented Interfaces:

org.springframework.beans.factory.Aware, org.springframework.beans.factory.SmartInitializingSingleton, org.springframework.context.annotation.ImportAware

@Configuration
 @EnableGlobalMethodSecurity(prePostEnabled=true)
public abstract class AbstractSpringGlobalMethodSecurityConfiguration
extends Object
implements org.springframework.context.annotation.ImportAware, org.springframework.beans.factory.SmartInitializingSingleton

Constructor Summary

Constructors

Constructor and Description
AbstractSpringGlobalMethodSecurityConfiguration()

Method Summary

Modifier and Type	Method and Description
protected org.springframework.security.access.AccessDecisionManager	accessDecisionManager() Allows subclasses to provide a custom AccessDecisionManager.
protected org.springframework.security.access.intercept.AfterInvocationManager	afterInvocationManager() Provide a custom AfterInvocationManager for the default implementation of methodSecurityInterceptor().
void	afterSingletonsInstantiated()
protected org.springframework.security.authentication.AuthenticationManager	authenticationManager() Allows providing a custom AuthenticationManager.
protected void	configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder auth) Sub classes can override this method to register different types of authentication.
protected org.springframework.security.access.expression.method.MethodSecurityExpressionHandler	createExpressionHandler() Provide a MethodSecurityExpressionHandler that is registered with the ExpressionBasedPreInvocationAdvice.
protected org.springframework.security.access.method.MethodSecurityMetadataSource	customMethodSecurityMetadataSource() Provides a custom MethodSecurityMetadataSource that is registered with the methodSecurityMetadataSource().
protected org.springframework.security.access.expression.method.MethodSecurityExpressionHandler	getExpressionHandler() Gets the MethodSecurityExpressionHandler or creates it using expressionHandler.
org.aopalliance.intercept.MethodInterceptor	methodSecurityInterceptor() Creates the default MethodInterceptor which is a MethodSecurityInterceptor using the following methods to construct it.
org.springframework.security.access.method.MethodSecurityMetadataSource	methodSecurityMetadataSource() Provides the default MethodSecurityMetadataSource that will be used.
org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice	preInvocationAuthorizationAdvice() Creates the PreInvocationAuthorizationAdvice to be used.
protected org.springframework.security.access.intercept.RunAsManager	runAsManager() Provide a custom RunAsManager for the default implementation of methodSecurityInterceptor().
void	setApplicationContext(org.springframework.context.ApplicationContext context)
void	setImportMetadata(org.springframework.core.type.AnnotationMetadata importMetadata) Obtains the attributes from EnableGlobalMethodSecurity if this class was imported using the EnableGlobalMethodSecurity annotation.
void	setJsr250MethodSecurityMetadataSource(org.springframework.security.access.annotation.Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource)
void	setMethodSecurityExpressionHandler(List<org.springframework.security.access.expression.method.MethodSecurityExpressionHandler> handlers)
void	setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor<Object> objectPostProcessor)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AbstractSpringGlobalMethodSecurityConfiguration

public AbstractSpringGlobalMethodSecurityConfiguration()

Method Detail

methodSecurityInterceptor

@Bean
public org.aopalliance.intercept.MethodInterceptor methodSecurityInterceptor()
                                                                            throws Exception

Creates the default MethodInterceptor which is a MethodSecurityInterceptor using the following methods to construct it.

• accessDecisionManager()
• afterInvocationManager()
• authenticationManager()
• methodSecurityMetadataSource()
• runAsManager()

Subclasses can override this method to provide a different MethodInterceptor.

Returns:

Throws:

Exception

afterSingletonsInstantiated

public void afterSingletonsInstantiated()

Specified by:

afterSingletonsInstantiated in interface org.springframework.beans.factory.SmartInitializingSingleton

afterInvocationManager

protected org.springframework.security.access.intercept.AfterInvocationManager afterInvocationManager()

Provide a custom AfterInvocationManager for the default implementation of methodSecurityInterceptor(). The default is null if pre post is not enabled. Otherwise, it returns a AfterInvocationProviderManager.

Subclasses should override this method to provide a custom AfterInvocationManager

Returns:

runAsManager

protected org.springframework.security.access.intercept.RunAsManager runAsManager()

Provide a custom RunAsManager for the default implementation of methodSecurityInterceptor(). The default is null.

Returns:

accessDecisionManager

protected org.springframework.security.access.AccessDecisionManager accessDecisionManager()

Allows subclasses to provide a custom AccessDecisionManager. The default is a AffirmativeBased with the following voters:

• PreInvocationAuthorizationAdviceVoter
• RoleVoter
• AuthenticatedVoter

Returns:

createExpressionHandler

protected org.springframework.security.access.expression.method.MethodSecurityExpressionHandler createExpressionHandler()

Provide a MethodSecurityExpressionHandler that is registered with the ExpressionBasedPreInvocationAdvice. The default is DefaultMethodSecurityExpressionHandler which optionally will Autowire an AuthenticationTrustResolver.

Subclasses may override this method to provide a custom MethodSecurityExpressionHandler

Returns:

getExpressionHandler

protected final org.springframework.security.access.expression.method.MethodSecurityExpressionHandler getExpressionHandler()

Gets the MethodSecurityExpressionHandler or creates it using expressionHandler.

Returns:

a non null MethodSecurityExpressionHandler

customMethodSecurityMetadataSource

protected org.springframework.security.access.method.MethodSecurityMetadataSource customMethodSecurityMetadataSource()

Provides a custom MethodSecurityMetadataSource that is registered with the methodSecurityMetadataSource(). Default is null.

Returns:

a custom MethodSecurityMetadataSource that is registered with the methodSecurityMetadataSource()

authenticationManager

protected org.springframework.security.authentication.AuthenticationManager authenticationManager()
                                                                                           throws Exception

Allows providing a custom AuthenticationManager. The default is to use any authentication mechanisms registered by configure(AuthenticationManagerBuilder). If configure(AuthenticationManagerBuilder) was not overridden, then an AuthenticationManager is attempted to be autowired by type.

Returns:

Throws:

Exception

configure

protected void configure(org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder auth)
                  throws Exception

Sub classes can override this method to register different types of authentication. If not overridden, configure(AuthenticationManagerBuilder) will attempt to autowire by type.

Parameters:

auth - the AuthenticationManagerBuilder used to register different authentication mechanisms for the global method security.

Throws:

Exception

methodSecurityMetadataSource

@Bean
public org.springframework.security.access.method.MethodSecurityMetadataSource methodSecurityMetadataSource()

Provides the default MethodSecurityMetadataSource that will be used. It creates a DelegatingMethodSecurityMetadataSource based upon customMethodSecurityMetadataSource() and the attributes on EnableGlobalMethodSecurity.

Returns:

preInvocationAuthorizationAdvice

@Bean
public org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice preInvocationAuthorizationAdvice()

Creates the PreInvocationAuthorizationAdvice to be used. The default is ExpressionBasedPreInvocationAdvice.

Returns:

setImportMetadata

public final void setImportMetadata(org.springframework.core.type.AnnotationMetadata importMetadata)

Obtains the attributes from EnableGlobalMethodSecurity if this class was imported using the EnableGlobalMethodSecurity annotation.

Specified by:

setImportMetadata in interface org.springframework.context.annotation.ImportAware

setObjectPostProcessor

@Autowired(required=false)
public void setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor<Object> objectPostProcessor)

setJsr250MethodSecurityMetadataSource

@Autowired(required=false)
public void setJsr250MethodSecurityMetadataSource(org.springframework.security.access.annotation.Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource)

setMethodSecurityExpressionHandler

@Autowired(required=false)
public void setMethodSecurityExpressionHandler(List<org.springframework.security.access.expression.method.MethodSecurityExpressionHandler> handlers)

setApplicationContext

@Autowired
public void setApplicationContext(org.springframework.context.ApplicationContext context)