Examples with ConfigAttribute org.springframework.security.access.ConfigAttribute used on opensource projects

Example 6 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security by spring-projects.

the class UnanimousBased method decide.

// ~ Methods
// ========================================================================================================
/**
	 * This concrete implementation polls all configured {@link AccessDecisionVoter}s for
	 * each {@link ConfigAttribute} and grants access if <b>only</b> grant (or abstain)
	 * votes were received.
	 * <p>
	 * Other voting implementations usually pass the entire list of
	 * <tt>ConfigAttribute</tt>s to the <code>AccessDecisionVoter</code>. This
	 * implementation differs in that each <code>AccessDecisionVoter</code> knows only
	 * about a single <code>ConfigAttribute</code> at a time.
	 * <p>
	 * If every <code>AccessDecisionVoter</code> abstained from voting, the decision will
	 * be based on the {@link #isAllowIfAllAbstainDecisions()} property (defaults to
	 * false).
	 *
	 * @param authentication the caller invoking the method
	 * @param object the secured object
	 * @param attributes the configuration attributes associated with the method being
	 * invoked
	 *
	 * @throws AccessDeniedException if access is denied
	 */
public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) throws AccessDeniedException {
    int grant = 0;
    int abstain = 0;
    List<ConfigAttribute> singleAttributeList = new ArrayList<ConfigAttribute>(1);
    singleAttributeList.add(null);
    for (ConfigAttribute attribute : attributes) {
        singleAttributeList.set(0, attribute);
        for (AccessDecisionVoter voter : getDecisionVoters()) {
            int result = voter.vote(authentication, object, singleAttributeList);
            if (logger.isDebugEnabled()) {
                logger.debug("Voter: " + voter + ", returned: " + result);
            }
            switch(result) {
                case AccessDecisionVoter.ACCESS_GRANTED:
                    grant++;
                    break;
                case AccessDecisionVoter.ACCESS_DENIED:
                    throw new AccessDeniedException(messages.getMessage("AbstractAccessDecisionManager.accessDenied", "Access is denied"));
                default:
                    abstain++;
                    break;
            }
        }
    }
    // To get this far, there were no deny votes
    if (grant > 0) {
        return;
    }
    // To get this far, every AccessDecisionVoter abstained
    checkAllowIfAllAbstainDecisions();
}

Example 7 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security by spring-projects.

the class RunAsManagerImpl method buildRunAs.

public Authentication buildRunAs(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
    List<GrantedAuthority> newAuthorities = new ArrayList<GrantedAuthority>();
    for (ConfigAttribute attribute : attributes) {
        if (this.supports(attribute)) {
            GrantedAuthority extraAuthority = new SimpleGrantedAuthority(getRolePrefix() + attribute.getAttribute());
            newAuthorities.add(extraAuthority);
        }
    }
    if (newAuthorities.size() == 0) {
        return null;
    }
    // Add existing authorities
    newAuthorities.addAll(authentication.getAuthorities());
    return new RunAsUserToken(this.key, authentication.getPrincipal(), authentication.getCredentials(), newAuthorities, authentication.getClass());
}

Example 8 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security by spring-projects.

the class AbstractFallbackMethodSecurityMetadataSource method getAttributes.

public Collection<ConfigAttribute> getAttributes(Method method, Class<?> targetClass) {
    // The method may be on an interface, but we need attributes from the target
    // class.
    // If the target class is null, the method will be unchanged.
    Method specificMethod = AopUtils.getMostSpecificMethod(method, targetClass);
    // First try is the method in the target class.
    Collection<ConfigAttribute> attr = findAttributes(specificMethod, targetClass);
    if (attr != null) {
        return attr;
    }
    // Second try is the config attribute on the target class.
    attr = findAttributes(specificMethod.getDeclaringClass());
    if (attr != null) {
        return attr;
    }
    if (specificMethod != method || targetClass == null) {
        // Fallback is to look at the original method.
        attr = findAttributes(method, method.getDeclaringClass());
        if (attr != null) {
            return attr;
        }
        // Last fallback is the class of the original method.
        return findAttributes(method.getDeclaringClass());
    }
    return Collections.emptyList();
}

Example 9 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security by spring-projects.

the class AbstractMethodSecurityMetadataSource method getAttributes.

// ~ Methods
// ========================================================================================================
public final Collection<ConfigAttribute> getAttributes(Object object) {
    if (object instanceof MethodInvocation) {
        MethodInvocation mi = (MethodInvocation) object;
        Object target = mi.getThis();
        Class<?> targetClass = null;
        if (target != null) {
            targetClass = target instanceof Class<?> ? (Class<?>) target : AopProxyUtils.ultimateTargetClass(target);
        }
        Collection<ConfigAttribute> attrs = getAttributes(mi.getMethod(), targetClass);
        if (attrs != null && !attrs.isEmpty()) {
            return attrs;
        }
        if (target != null && !(target instanceof Class<?>)) {
            attrs = getAttributes(mi.getMethod(), target.getClass());
        }
        return attrs;
    }
    throw new IllegalArgumentException("Object must be a non-null MethodInvocation");
}

Example 10 with ConfigAttribute

use of org.springframework.security.access.ConfigAttribute in project spring-security by spring-projects.

the class Jsr250MethodSecurityMetadataSourceTests method annotationsOnOverriddenMemberIgnored.

@Test
public void annotationsOnOverriddenMemberIgnored() throws Exception {
    Child target = new Child();
    MockMethodInvocation mi = new MockMethodInvocation(target, target.getClass(), "overridenIgnored");
    Collection<ConfigAttribute> accessAttributes = this.mds.getAttributes(mi);
    assertThat(accessAttributes).hasSize(1);
    assertThat(accessAttributes.toArray()[0].toString()).isEqualTo("ROLE_DERIVED");
}