How do I extend Spring Global Method Security expression handling without losing the original expression handling

Viewed 16

Given I have a SpringBoot application (v2.7) that uses Spring Security EL in @PreAuthorize annotated methods on controllers and services:

@PreAuthorize("hasAnyAuthority('PROFILE_TEAM_MGR')")
fun updateUsersTeam(user: User, teamId: String?) {
    // ...
}

I have added an implementation of GlobalMethodSecurityConfiguration to my spring context:

@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
class MethodSecurity : GlobalMethodSecurityConfiguration() {

}

And this works as expected.

When I now want to use custom expressions using a custom expression handler to implement some legacy security checks:

@Autowired
lateinit var evaluator: LegacyPermissionEvaluator

override fun createExpressionHandler(): MethodSecurityExpressionHandler {
    val handler = DefaultMethodSecurityExpressionHandler()
    handler.setPermissionEvaluator(evaluator)
    return handler
}

to the MethodSecurity class, then in unit tests the new @PreAuthorize annotations work fine, but the original has[Any]Authority expression is suddenly ignored. I can comment out the overwritten method and it begins to work again. How can I use both standard and custom permission evaluation at together?

0 Answers
Related