Using custom spring security annotations

Question

I'm trying to make use of springs security annotations like @PreAuthorize and @Secured but Im looking to evaluate a user not on a role but whether they have permissions to a particular entity in this case a firm. In my controller I receive a http request containing a firmId as a parameter and I want to make sure this user is permissioned to this firm. Is this possible using the current spring security annotations?. Im looking for an elegant solution, i've been looking at custom constraint validators as part of the jsr303 specification. Method header below.

public ModelAndView getSessionsJson(HttpServletRequest request,
  HttpServletResponse response) throws ServletRequestBindingException {}

Maksym Demidas Maksym Demidas · Accepted Answer · 2013-05-29T15:58:13

I think you can do something like this:

public ModelAndView getSessionsJson(HttpServletRequest request, HttpServletResponse response) throws ServletRequestBindingException { 
    Integer firmId = getFirmId(request);
    Firm firm = getFirmById(firmId);
    doSomeBusinessLogic(firm);
    .....
}

@PreAuthorize("hasPermission(#firm, 'admin')")
public void doSomeBusinessLogic(Firm firm) {
     ....
}

....

using pre and post annotations in conjuction with ACL module. Of course before you need to set up ACL DB schema and prepare ACL permissions for each firm object.

Using custom spring security annotations

1 Answers