How to use spring security3.0.3 to secure such business logic?

I have such a requirement. There is a main business object,user a and user b, and administrator. User a or b can create/update/delete their own business object. And user a can't modify user b's business object. Administrator can do every thing. And the business object has a status, in some status, even the owner user can't modify it. I want to secure this by spring security.But it seems can achieve it just by role based security. I feel I need to use spring voter开发者_如何转开发,but I don't know how to configure. Can anybody provide some code snip or give me suggestion?

Thanks in advance.

Spring Security 3 supports @PreAuthorize annotation that allows you to express authorization logic in Spring Expression Language, like this:

public class BusinessService {
    @PreAuthorize("hasRole('ADMINISTRATOR') or " + 
        "(#o.status != 'someStatus' and hasRole('USER') and #o.ownerName == principal.name)")
    public void updateBusinessObject(BusinessObject o) {
        ...
    }
}

And you need <security:global-method-security pre-post-annotations="enabled"/> to apply security aspect.

If the expression is too complex to represent in Spring Expression Language, you can move some logic to Java code by adding custom variables into expression's EvaluationContext (by customizing MethodSecurityExpressionHandler).

Note, however, that you need to have your code compiled in debug mode in order to use method arguments in the expression.

See also:

• 15.3.1 @Pre and @Post Annotations