Announcement Announcement Module
Collapse
No announcement yet.
Custom PermissionEvaluator is not getting invoked Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • Custom PermissionEvaluator is not getting invoked

    CustomPermissionEvaluator is not getting invoked

    I have implemented a Custom PermissionEvaluator and configured it as follows

    <bean class="com.web.security.EmailAddressAuthentication Provider" id="authenticationProvider" />
    <security:http pattern="/c" security="none" />
    <security:http pattern="/d" security="none" />
    <security:http pattern="/i" security="none" />
    <security:http pattern="/s" security="none" />

    <security:http access-denied-page="/" auto-config="true" use-expressions="true">
    <security:anonymous />
    <security:form-login always-use-default-target="false" default-target-url="/people/login/redirect" login-page="/people/login" login-processing-url="/people/login/submit" password-parameter="password" username-parameter="emailAddress" />
    <security:logout delete-cookies="true" invalidate-session="true" logout-success-url="/people/login/redirect" logout-url="/people/logout" />
    </security:http>

    <security:authentication-manager erase-credentials="false">
    <security:authentication-provider ref="authenticationProvider" />
    </security:authentication-manager>

    <security:global-method-security jsr250-annotations="enabled" pre-post-annotations="enabled" secured-annotations="enabled" >
    <security:expression-handler ref="expressionHandler"/>
    </security:global-method-security>


    <bean id="expressionHandler" class="org.springframework.security.access.express ion.method.DefaultMethodSecurityExpressionHandler" >
    <property name="permissionEvaluator" ref="appPermissionEvaluator"/>
    </bean>

    <bean class="com.web.security.ApplicationPermissionEvalu ator" id="appPermissionEvaluator" />


    Then I applied hasPermissionCheck on one method on one of my ControllerClass as follows

    @PreAuthorize("hasPermission(#accountCode, 'AdministerPosition')")
    @RequestMapping(method = RequestMethod.GET, value = "/cloud/{account}/position")
    public String list(@PathVariable String account, @RequestParam(required = false, value = URLParameter.ACCOUNT_CODE) final String accountCode, final Model model) {

    }

    Here in this case I never get a control in my ApplicationPermissionEvaluator class.

    I found that always DenyAllPermissionEvaluator gets executed in my case with following error message
    DenyAllPermissionEvaluator - Denying user ****** permission 'AdministerPosition'

    Please advice me on this asap. I am really stuck on this.
    Last edited by singla29; Sep 24th, 2012, 05:07 AM.
Working...
X