Given I have a SpringBoot application (v2.7) that uses Spring Security EL in @PreAuthorize annotated methods on controllers and services:
@PreAuthorize("hasAnyAuthority('PROFILE_TEAM_MGR')")
fun updateUsersTeam(user: User, teamId: String?) {
// ...
}
I have added an implementation of GlobalMethodSecurityConfiguration to my spring context:
@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
class MethodSecurity : GlobalMethodSecurityConfiguration() {
}
And this works as expected.
When I now want to use custom expressions using a custom expression handler to implement some legacy security checks:
@Autowired
lateinit var evaluator: LegacyPermissionEvaluator
override fun createExpressionHandler(): MethodSecurityExpressionHandler {
val handler = DefaultMethodSecurityExpressionHandler()
handler.setPermissionEvaluator(evaluator)
return handler
}
to the MethodSecurity class, then in unit tests the new @PreAuthorize annotations work fine, but the original has[Any]Authority expression is suddenly ignored. I can comment out the overwritten method and it begins to work again. How can I use both standard and custom permission evaluation at together?