|
|
|
|
@ -1428,15 +1428,13 @@ Java::
@@ -1428,15 +1428,13 @@ Java::
|
|
|
|
|
class MethodSecurityConfig { |
|
|
|
|
@Bean |
|
|
|
|
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) |
|
|
|
|
Advisor preAuthorize() { |
|
|
|
|
MyPreAuthorizeAuthorizationManager manager = new MyPreAuthorizeAuthorizationManager(); |
|
|
|
|
Advisor preAuthorize(MyPreAuthorizeAuthorizationManager manager) { |
|
|
|
|
return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) |
|
|
|
|
Advisor postAuthorize() { |
|
|
|
|
MyPostAuthorizeAuthorizationManager manager = new MyPostAuthorizeAuthorizationManager(); |
|
|
|
|
Advisor postAuthorize(MyPostAuthorizeAuthorizationManager manager) { |
|
|
|
|
return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager); |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
@ -1449,19 +1447,17 @@ Kotlin::
@@ -1449,19 +1447,17 @@ Kotlin::
|
|
|
|
|
@Configuration |
|
|
|
|
@EnableMethodSecurity(prePostEnabled = false) |
|
|
|
|
class MethodSecurityConfig { |
|
|
|
|
@Bean |
|
|
|
|
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) |
|
|
|
|
fun preAuthorize(): Advisor { |
|
|
|
|
val manager = MyPreAuthorizeAuthorizationManager() |
|
|
|
|
return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager) |
|
|
|
|
} |
|
|
|
|
@Bean |
|
|
|
|
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) |
|
|
|
|
fun preAuthorize(manager: MyPreAuthorizeAuthorizationManager): Advisor { |
|
|
|
|
return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager) |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Bean |
|
|
|
|
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) |
|
|
|
|
fun postAuthorize(): Advisor { |
|
|
|
|
val manager = MyPostAuthorizeAuthorizationManager() |
|
|
|
|
return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager) |
|
|
|
|
} |
|
|
|
|
@Bean |
|
|
|
|
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) |
|
|
|
|
fun postAuthorize(manager: MyPostAuthorizeAuthorizationManager): Advisor { |
|
|
|
|
return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager) |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
---- |
|
|
|
|
|
|
|
|
|
@ -1476,11 +1472,13 @@ Xml::
@@ -1476,11 +1472,13 @@ Xml::
|
|
|
|
|
<bean id="preAuthorize" |
|
|
|
|
class="org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor" |
|
|
|
|
factory-method="preAuthorize"> |
|
|
|
|
<constructor-arg ref="myPreAuthorizeAuthorizationManager"/> |
|
|
|
|
</bean> |
|
|
|
|
|
|
|
|
|
<bean id="postAuthorize" |
|
|
|
|
class="org.springframework.security.authorization.method.AuthorizationManagerAfterMethodInterceptor" |
|
|
|
|
factory-method="postAuthorize"> |
|
|
|
|
<constructor-arg ref="myPostAuthorizeAuthorizationManager"/> |
|
|
|
|
</bean> |
|
|
|
|
---- |
|
|
|
|
====== |
|
|
|
|
@ -1490,7 +1488,7 @@ Xml::
@@ -1490,7 +1488,7 @@ Xml::
|
|
|
|
|
You can place your interceptor in between Spring Security method interceptors using the order constants specified in `AuthorizationInterceptorsOrder`. |
|
|
|
|
==== |
|
|
|
|
|
|
|
|
|
Additionally, you can also implement `MethodAuthorizationDeniedHandler` by the same manager, to override default exception handling behavior. |
|
|
|
|
You can also implement `MethodAuthorizationDeniedHandler` in the same manager class to override the default exception-handling behavior. |
|
|
|
|
|
|
|
|
|
[[customizing-expression-handling]] |
|
|
|
|
=== Customizing Expression Handling |
|
|
|
|
|