@PreAuthorize annotation wrapper with list of allowed roles

Viewed 344

I want to create a custom Allows annotation, which contains @PreAuthorize and has an array of allowed roles.

The best it would be to look like this:

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("@accessService.isAllowed(#values, authentication.principal)")
public @interface Allows {
    String[] values() default {};
}

Unfortunately I cannot use spring based method, since the application has two different set of roles, one for authentication and this one for authorization.

Is there a way to pass the array of roles like this to the @PreAuthorize SPeL?

0 Answers
Related