How to use role-hierarchy in Spring Security 3 with Spring EL?
I want to use @PreAuthorize annotation on service methods with Spring Security. One of requirements is to use role-hierarchy. But by default it is not enabled.
I found that in SecurityExpressionRoot class ("the base class for expression root objects") there is a property roleHierarchy. The class actually does use this property for methods like hasRole() and hasAnyRole().
I suppose that if I supply it with my own RoleHierarchy bean I will be able to use @PreAuthorize annotations开发者_StackOverflow with hierarchical roles.
How can I inject my hierarchy bean into SecurityExpressionRoot?
For method security you can set RoleHierarchy
as a property of DefaultMethodSecurityExpressionHandler
, something like this:
<global-method-security ...>
<expression-handler ref = "methodSecurityExpressionHandler" />
</global-method-security>
<beans:bean id = "methodSecurityExpressionHandler"
class = "org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
<beans:property name = "roleHierarchy" .../>
</beans:bean>
精彩评论