Example usage for org.springframework.security.access.expression.method ExpressionBasedAnnotationAttributeFactory createPreInvocationAttribute

Introduction

In this page you can find the example usage for org.springframework.security.access.expression.method ExpressionBasedAnnotationAttributeFactory createPreInvocationAttribute.

Prototype

public PreInvocationAttribute createPreInvocationAttribute(String preFilterAttribute, String filterObject,
            String preAuthorizeAttribute) 

Source Link

Usage

From source file:org.vaadin.spring.security.navigation.PreAuthorizeViewInstanceAccessControl.java

@Override
public boolean isAccessGranted(UI ui, String beanName, View view) {
    final PreAuthorize viewSecured = applicationContext.findAnnotationOnBean(beanName, PreAuthorize.class);

    if (viewSecured == null) {
        logger.trace("No @PreAuthorize annotation found on view {}. Granting access.", beanName);
        return true;
    } else if (security.hasAccessDecisionManager()) {
        final Class<?> targetClass = AopUtils.getTargetClass(view);
        final Method method = ClassUtils.getMethod(targetClass, "enter",
                com.vaadin.navigator.ViewChangeListener.ViewChangeEvent.class);
        final MethodInvocation methodInvocation = MethodInvocationUtils.createFromClass(targetClass,
                method.getName());//from   ww w  . j a va  2  s .c  o  m

        final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        final AccessDecisionManager accessDecisionManager = security.getAccessDecisionManager();
        final ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory(
                new DefaultMethodSecurityExpressionHandler());

        final Collection<ConfigAttribute> attributes = Collections.singleton((ConfigAttribute) attributeFactory
                .createPreInvocationAttribute(null, null, viewSecured.value()));

        try {
            accessDecisionManager.decide(authentication, methodInvocation, attributes);
            logger.trace("Access to view {} was granted by access decision manager", beanName);
            return true;
        } catch (InsufficientAuthenticationException e) {
            logger.trace("Access to view {} was denied because of insufficient authentication credentials",
                    beanName);
            return false;
        } catch (AccessDeniedException e) {
            logger.trace("Access to view {} was denied", beanName);
            return false;
        }
    } else {
        logger.warn(
                "Found view {} annotated with @PreAuthorize but no access decision manager. Granting access.",
                beanName);
        return true;
    }
}

---

From source file:org.vaadin.spring.security.provider.PreAuthorizeViewProviderAccessDelegate.java

@Override
public boolean isAccessGranted(UI ui, String beanName) {

    PreAuthorize viewSecured = applicationContext.findAnnotationOnBean(beanName, PreAuthorize.class);

    if (viewSecured == null) {
        return true;
    } else if (security.hasAccessDecisionManager()) {

        final Class<?> targetClass = AopUtils.getTargetClass(applicationContext.getBean(beanName));
        final Method method = ClassUtils.getMethod(
                AopUtils.getTargetClass(applicationContext.getBean(beanName)), "enter",
                com.vaadin.navigator.ViewChangeListener.ViewChangeEvent.class);
        final MethodInvocation methodInvocation = MethodInvocationUtils.createFromClass(targetClass,
                method.getName());//ww w.ja v  a 2 s. co m

        final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        final AccessDecisionManager accessDecisionManager = security.getAccessDecisionManager();
        final ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory(
                new DefaultMethodSecurityExpressionHandler());

        Collection<ConfigAttribute> atributi = new ArrayList<ConfigAttribute>();
        atributi.add(attributeFactory.createPreInvocationAttribute(null, null, viewSecured.value()));

        try {
            accessDecisionManager.decide(authentication, methodInvocation, atributi);
            return true;
        } catch (InsufficientAuthenticationException e) {
            return false;
        } catch (AccessDeniedException e) {
            return false;
        }

    } else {
        return true; // Access decision manager required for @PreAuthorize()
    }

}

---