Spring 4 - サービスを使用したカスタムセキュリティエクスプレッション

Question

私のコントローラの1つでは、ロールよりも細かい手段でメソッドを保護する必要があります。

MethodSecurityExpressionHandlerが作成されましたが、私の@Servicesにアクセスする方法がわかりません。

@Configuration 
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, proxyTargetClass = false) 
    public class CustomMethodSecurityConfiguration extends GlobalMethodSecurityConfiguration { 
    @Autowired 
    ApplicationContext applicationContext; 
    @Override 
    protected MethodSecurityExpressionHandler createExpressionHandler() { 
     CustomMethodSecurityExpressionHandler handler = new CustomMethodSecurityExpressionHandler(); 
     handler.setApplicationContext(applicationContext); 
     return super.createExpressionHandler(); 
    } 
    @Bean 
    public MethodSecurityExpressionHandler expressionHandler() { 
     return new CustomMethodSecurityExpressionHandler(); 
    } 
} 

public class CustomMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler { 

    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl(); 

    @Override 
    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, 
                       MethodInvocation invocation) { 
     final CustomMethodSecurityExpressionRoot root = new CustomMethodSecurityExpressionRoot(authentication); 
     root.setThis(invocation.getThis()); 
     root.setPermissionEvaluator(getPermissionEvaluator()); 
     root.setTrustResolver(this.trustResolver); 
     root.setRoleHierarchy(getRoleHierarchy()); 

     return root; 
    } 
} 


public class CustomMethodSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations { 

    private Object filterObject; 
    private Object returnObject; 
    private Object target; 

    //**This is what I need to work** 
    @Autowired 
    private RepositoryService repositoryService; 

    public boolean canViewFolder(String uuid){ 
     User currentUser = (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal(); 
     return repositoryService.checkFolderPermissions(currentUser.getUsername(), uuid); 
    } 

    public CustomMethodSecurityExpressionRoot(Authentication a) { 
     super(a); 
    } 

    public void setFilterObject(Object filterObject) { 
     this.filterObject = filterObject; 
    } 

    public Object getFilterObject() { 
     return filterObject; 
    } 

    public void setReturnObject(Object returnObject) { 
     this.returnObject = returnObject; 
    } 

    public Object getReturnObject() { 
     return returnObject; 
    } 

    void setThis(Object target) { 
     this.target = target; 
    } 

    public Object getThis() { 
     return target; 
    } 

} 

Answer 1

あなたがアクセス可能レベルで合格のApplicationContextを持っている

CustomMethodSecurityExpressionRoot

にCustomMethodSecurityExpressionHandlerで上書きsetApplicationContextをごRepositoryServiceためのセッターを作成します。

コンテキストのRepositoryService BeanのapplicationContextパスを使用してcreateSecurityExpressionRootを実行します。コードは以下のとおりです。また、createExpressionHandler（）とexpressionHandler（）に対して行った変更にも注意してください。 ExpressionHandlerの作成では、単に2行前に新しく作成したオブジェクトではなく、デフォルトの実装を使用するsuperを呼び出しています。 expressionHandler（）では、createExpressionHandler（）で作成しているインスタンスを取得せずに、CustomMethodSecurityExpressionHandler（）の新しいインスタンスを作成しています。

@Configuration 
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, proxyTargetClass = false) 
    public class CustomMethodSecurityConfiguration extends GlobalMethodSecurityConfiguration { 
    @Autowired 
    ApplicationContext applicationContext; 
    @Override 
    protected MethodSecurityExpressionHandler createExpressionHandler() { 
     CustomMethodSecurityExpressionHandler handler = new CustomMethodSecurityExpressionHandler(); 
     handler.setApplicationContext(applicationContext); 
     return handler; 
    } 
    @Bean 
    public MethodSecurityExpressionHandler expressionHandler() { 
     return createExpressionHandler(); 
    } 
} 

public class CustomMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler { 

    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl(); 
    private ApplicationContext applicationContext; 
    @Override 
    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, 
                       MethodInvocation invocation) { 
     final CustomMethodSecurityExpressionRoot root = new CustomMethodSecurityExpressionRoot(authentication); 
     root.setThis(invocation.getThis()); 
     root.setPermissionEvaluator(getPermissionEvaluator()); 
     root.setTrustResolver(this.trustResolver); 
     root.setRoleHierarchy(getRoleHierarchy()); 
     root.setRepositoryService(applicationContext.getBean(RepositoryService.class); 
     return root; 
    } 

    @Override 
    protected void setApplicationContext(applicationContext){ 
     super.setApplicationContext(applicationContext); 
     this.applicationContext = applicationContext; 
    } 
} 


public class CustomMethodSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations { 

    private Object filterObject; 
    private Object returnObject; 
    private Object target; 
    private RepositoryService repositoryService; 

    public boolean canViewFolder(String uuid){ 
     User currentUser = (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal(); 
     return repositoryService.checkFolderPermissions(currentUser.getUsername(), uuid); 
    } 

    public CustomMethodSecurityExpressionRoot(Authentication a) { 
     super(a); 
    } 

    public void setFilterObject(Object filterObject) { 
     this.filterObject = filterObject; 
    } 

    public Object getFilterObject() { 
     return filterObject; 
    } 

    public void setReturnObject(Object returnObject) { 
     this.returnObject = returnObject; 
    } 

    public Object getReturnObject() { 
     return returnObject; 
    } 

    void setThis(Object target) { 
     this.target = target; 
    } 

    public Object getThis() { 
     return target; 
    } 

    public void setRepositoryService(RepositoryService repositoryService){ 
     this.repositoryService = repositoryService; 
    } 
}