Examples with MethodSecurityMetadataSource org.springframework.security.access.method.MethodSecurityMetadataSource used on opensource projects

Example 6 with MethodSecurityMetadataSource

use of org.springframework.security.access.method.MethodSecurityMetadataSource in project spring-security by spring-projects.

the class MethodSecurityMetadataSourceAdvisorTests method testAdvisorReturnsFalseWhenMethodInvocationNotDefined.

@Test
public void testAdvisorReturnsFalseWhenMethodInvocationNotDefined() throws Exception {
    Class<TargetObject> clazz = TargetObject.class;
    Method method = clazz.getMethod("makeLowerCase", new Class[] { String.class });
    MethodSecurityMetadataSource mds = mock(MethodSecurityMetadataSource.class);
    given(mds.getAttributes(method, clazz)).willReturn(null);
    MethodSecurityMetadataSourceAdvisor advisor = new MethodSecurityMetadataSourceAdvisor("", mds, "");
    assertThat(advisor.getPointcut().getMethodMatcher().matches(method, clazz)).isFalse();
}

Example 7 with MethodSecurityMetadataSource

use of org.springframework.security.access.method.MethodSecurityMetadataSource in project spring-security by spring-projects.

the class GlobalMethodSecurityConfiguration method methodSecurityMetadataSource.

/**
 * Provides the default {@link MethodSecurityMetadataSource} that will be used. It
 * creates a {@link DelegatingMethodSecurityMetadataSource} based upon
 * {@link #customMethodSecurityMetadataSource()} and the attributes on
 * {@link EnableGlobalMethodSecurity}.
 * @return the {@link MethodSecurityMetadataSource}
 */
@Bean
@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
public MethodSecurityMetadataSource methodSecurityMetadataSource() {
    List<MethodSecurityMetadataSource> sources = new ArrayList<>();
    ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory(getExpressionHandler());
    MethodSecurityMetadataSource customMethodSecurityMetadataSource = customMethodSecurityMetadataSource();
    if (customMethodSecurityMetadataSource != null) {
        sources.add(customMethodSecurityMetadataSource);
    }
    boolean hasCustom = customMethodSecurityMetadataSource != null;
    boolean isPrePostEnabled = prePostEnabled();
    boolean isSecuredEnabled = securedEnabled();
    boolean isJsr250Enabled = jsr250Enabled();
    Assert.state(isPrePostEnabled || isSecuredEnabled || isJsr250Enabled || hasCustom, "In the composition of all global method configuration, " + "no annotation support was actually activated");
    if (isPrePostEnabled) {
        sources.add(new PrePostAnnotationSecurityMetadataSource(attributeFactory));
    }
    if (isSecuredEnabled) {
        sources.add(new SecuredAnnotationSecurityMetadataSource());
    }
    if (isJsr250Enabled) {
        GrantedAuthorityDefaults grantedAuthorityDefaults = getSingleBeanOrNull(GrantedAuthorityDefaults.class);
        Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource = this.context.getBean(Jsr250MethodSecurityMetadataSource.class);
        if (grantedAuthorityDefaults != null) {
            jsr250MethodSecurityMetadataSource.setDefaultRolePrefix(grantedAuthorityDefaults.getRolePrefix());
        }
        sources.add(jsr250MethodSecurityMetadataSource);
    }
    return new DelegatingMethodSecurityMetadataSource(sources);
}

Example 8 with MethodSecurityMetadataSource

use of org.springframework.security.access.method.MethodSecurityMetadataSource in project spring-security by spring-projects.

the class GlobalMethodSecurityConfigurationTests method methodSecurityInterceptorUsesMetadataSourceBeanWhenProxyingDisabled.

@Test
public void methodSecurityInterceptorUsesMetadataSourceBeanWhenProxyingDisabled() {
    this.spring.register(CustomMetadataSourceBeanProxyEnabledConfig.class).autowire();
    MethodSecurityInterceptor methodInterceptor = (MethodSecurityInterceptor) this.spring.getContext().getBean(MethodInterceptor.class);
    MethodSecurityMetadataSource methodSecurityMetadataSource = this.spring.getContext().getBean(MethodSecurityMetadataSource.class);
    assertThat(methodInterceptor.getSecurityMetadataSource()).isSameAs(methodSecurityMetadataSource);
}