Announcement Announcement Module
Collapse
No announcement yet.
@PreAuthorize and several targets Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • @PreAuthorize and several targets

    SOLVED !

    Hi guys,

    I'm using the @PreAuthorize (and a custom permission evaluator).

    It's possible to put several arguments (I'am using this annotation in mi services layer... where I'm using several primitive variables)?, example:

    Code:
    @Service
    public interface MyInterfaceService {
    
    @PreAuthorize ("hasPermission (#paramIdOne, #paramIdTwo, 'methodA')")
    void methodA(String paramIdOne, String paramIdTwo);
    
    @PreAuthorize ("hasPermission (#paramIdOne, #paramIdTwo, 'methodB')")
    void methodB(Object paramIdOne, Object paramIdTwo);
    }
    Last edited by studela; Mar 22nd, 2012, 10:35 AM. Reason: Solved

  • #2
    So, I'm looking more closely at the process and I don't know if is possible: using "Spring Expression Language (SPEL)" could create a "List<Object>" with the several parameters and pass the "targetDomainObject" with this "List<Object>" for evaluate the permissions.

    Is this possible?

    Comment


    • #3
      Hi guys again,

      I've solved it. I used "Spring Expression Language (SPEL)" to pass multiple parameters. Example:

      Code:
      @Service
      @Secured('USER_AUTHENTICATED')
      public interface MyService {
      
             @PreAuthorize("hasPermission(new com.example.MyAuthorityListTargetDomainObject(#oneId, #twoId),
                           'havePermissionForFindByIdOneAndIdTwo'")
             public List<Object> findByIdOneAndIdTwo(final String oneId, final String twoId);
      
      }
      Code:
      public class MyAuthorityListTargetDomainObject extends ArrayList<Object> {
      
      	private static final long	serialVersionUID	= 5623754512642752902L;
      
      	public MyAuthorityListTargetDomainObject(Object... objects) {
      		super();
      		for (Object object : objects) {
      			super.add(object);
      		}
      	}
      
      }
      Code:
      public class MyPermissionEvaluator implements PermissionEvaluator, InitializingBean {
      
      ...
      
              @Override
      	public boolean hasPermission(Authentication authentication, Object targetDomainObject, 
                                           Object permission) {
                      ...
                      if (permission.equals("havePermissionForFindByIdOneAndIdTwo")) {
                              // NICE !!!
                              MyAuthorityListTargetDomainObject authorityListTargetDomainObject = 
                                  (MyAuthorityListTargetDomainObject) targetDomainObject;
      			return false;
      		}
                      ...
      	}
      
      ...
      
      }
      Sorry if any mistake, is an example. In my real project is working! Thanks guys!
      Last edited by studela; Mar 22nd, 2012, 10:54 AM.

      Comment

      Working...
      X