Package org.springframework.security.authorization.method

Class AuthorizationManagerBeforeMethodInterceptor

java.lang.Object

org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor

All Implemented Interfaces:

org.aopalliance.aop.Advice, org.aopalliance.intercept.Interceptor, org.aopalliance.intercept.MethodInterceptor, org.springframework.aop.Advisor, org.springframework.aop.framework.AopInfrastructureBean, org.springframework.aop.PointcutAdvisor, org.springframework.core.Ordered, AuthorizationAdvisor

public final class AuthorizationManagerBeforeMethodInterceptor
extends Object
implements AuthorizationAdvisor

A MethodInterceptor which uses a AuthorizationManager to determine if an Authentication may invoke the given MethodInvocation

Since:

5.6

Field Summary

Fields inherited from interface org.springframework.aop.Advisor

EMPTY_ADVICE

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor	Description
AuthorizationManagerBeforeMethodInterceptor(org.springframework.aop.Pointcut pointcut, AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)	Creates an instance.

Method Summary

Modifier and Type	Method	Description
org.aopalliance.aop.Advice	getAdvice()
int	getOrder()
org.springframework.aop.Pointcut	getPointcut()
@Nullable Object	invoke(org.aopalliance.intercept.MethodInvocation mi)	Determine if an Authentication has access to the MethodInvocation using the configured AuthorizationManager.
boolean	isPerInstance()
static AuthorizationManagerBeforeMethodInterceptor	jsr250()	Creates an interceptor for the JSR-250 annotations
static AuthorizationManagerBeforeMethodInterceptor	jsr250(AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)	Creates an interceptor for the JSR-250 annotations
static AuthorizationManagerBeforeMethodInterceptor	jsr250(Jsr250AuthorizationManager authorizationManager)	Creates an interceptor for the JSR-250 annotations
static AuthorizationManagerBeforeMethodInterceptor	preAuthorize()	Creates an interceptor for the PreAuthorize annotation
static AuthorizationManagerBeforeMethodInterceptor	preAuthorize(AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)	Creates an interceptor for the PreAuthorize annotation
static AuthorizationManagerBeforeMethodInterceptor	preAuthorize(PreAuthorizeAuthorizationManager authorizationManager)	Creates an interceptor for the PreAuthorize annotation
static AuthorizationManagerBeforeMethodInterceptor	secured()	Creates an interceptor for the Secured annotation
static AuthorizationManagerBeforeMethodInterceptor	secured(AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)	Creates an interceptor for the Secured annotation
static AuthorizationManagerBeforeMethodInterceptor	secured(SecuredAuthorizationManager authorizationManager)	Creates an interceptor for the Secured annotation
void	setAuthorizationEventPublisher(AuthorizationEventPublisher eventPublisher)	Use this AuthorizationEventPublisher to publish the AuthorizationManager result.
void	setOrder(int order)
void	setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy)	Sets the SecurityContextHolderStrategy to use.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AuthorizationManagerBeforeMethodInterceptor

public AuthorizationManagerBeforeMethodInterceptor(org.springframework.aop.Pointcut pointcut,
 AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)

Creates an instance.

Parameters:

pointcut - the Pointcut to use

authorizationManager - the AuthorizationManager to use

Method Details

preAuthorize

public static AuthorizationManagerBeforeMethodInterceptor preAuthorize()

Creates an interceptor for the PreAuthorize annotation

Returns:

the interceptor

preAuthorize

public static AuthorizationManagerBeforeMethodInterceptor preAuthorize(PreAuthorizeAuthorizationManager authorizationManager)

Creates an interceptor for the PreAuthorize annotation

Parameters:

authorizationManager - the PreAuthorizeAuthorizationManager to use

Returns:

the interceptor

preAuthorize

public static AuthorizationManagerBeforeMethodInterceptor preAuthorize(AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)

Creates an interceptor for the PreAuthorize annotation

Parameters:

authorizationManager - the AuthorizationManager to use

Returns:

the interceptor

Since:

6.0

secured

public static AuthorizationManagerBeforeMethodInterceptor secured()

Creates an interceptor for the Secured annotation

Returns:

the interceptor

secured

public static AuthorizationManagerBeforeMethodInterceptor secured(SecuredAuthorizationManager authorizationManager)

Creates an interceptor for the Secured annotation

Parameters:

authorizationManager - the SecuredAuthorizationManager to use

Returns:

the interceptor

secured

public static AuthorizationManagerBeforeMethodInterceptor secured(AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)

Creates an interceptor for the Secured annotation

Parameters:

authorizationManager - the AuthorizationManager to use

Returns:

the interceptor

Since:

6.0

jsr250

public static AuthorizationManagerBeforeMethodInterceptor jsr250()

Creates an interceptor for the JSR-250 annotations

Returns:

the interceptor

jsr250

public static AuthorizationManagerBeforeMethodInterceptor jsr250(Jsr250AuthorizationManager authorizationManager)

Creates an interceptor for the JSR-250 annotations

Parameters:

authorizationManager - the Jsr250AuthorizationManager to use

Returns:

the interceptor

jsr250

public static AuthorizationManagerBeforeMethodInterceptor jsr250(AuthorizationManager<org.aopalliance.intercept.MethodInvocation> authorizationManager)

Creates an interceptor for the JSR-250 annotations

Parameters:

authorizationManager - the AuthorizationManager to use

Returns:

the interceptor

Since:

6.0

invoke

public @Nullable Object invoke(org.aopalliance.intercept.MethodInvocation mi)
                        throws Throwable

Determine if an Authentication has access to the MethodInvocation using the configured AuthorizationManager.

Specified by:

invoke in interface org.aopalliance.intercept.MethodInterceptor

Parameters:

mi - the MethodInvocation to check

Throws:

AccessDeniedException - if access is not granted

Throwable

getOrder

public int getOrder()

Specified by:

getOrder in interface org.springframework.core.Ordered

setOrder

public void setOrder(int order)

setAuthorizationEventPublisher

public void setAuthorizationEventPublisher(AuthorizationEventPublisher eventPublisher)

Use this AuthorizationEventPublisher to publish the AuthorizationManager result.

Parameters:

eventPublisher -

Since:

5.7

getPointcut

public org.springframework.aop.Pointcut getPointcut()

Specified by:

getPointcut in interface org.springframework.aop.PointcutAdvisor

getAdvice

public org.aopalliance.aop.Advice getAdvice()

Specified by:

getAdvice in interface org.springframework.aop.Advisor

isPerInstance

public boolean isPerInstance()

Specified by:

isPerInstance in interface org.springframework.aop.Advisor

setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy)

Sets the SecurityContextHolderStrategy to use. The default action is to use the SecurityContextHolderStrategy stored in SecurityContextHolder.

Since:

5.8