Examples with DefaultWebSecurityExpressionHandler org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler used on opensource projects

Example 1 with DefaultWebSecurityExpressionHandler

use of org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler in project ocvn by devgateway.

the class WebSecurityConfig method webExpressionHandler.

/**
 * Instantiates {@see DefaultWebSecurityExpressionHandler} and assigns to it role hierarchy.
 *
 * @return
 */
private SecurityExpressionHandler<FilterInvocation> webExpressionHandler() {
    DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
    handler.setRoleHierarchy(roleHierarchy());
    return handler;
}

Example 2 with DefaultWebSecurityExpressionHandler

use of org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler in project hub-alert by blackducksoftware.

the class AuthenticationHandler method createRoleProcessor.

private ObjectPostProcessor<AffirmativeBased> createRoleProcessor() {
    return new ObjectPostProcessor<>() {

        @Override
        public <O extends AffirmativeBased> O postProcess(O affirmativeBased) {
            WebExpressionVoter webExpressionVoter = new WebExpressionVoter();
            DefaultWebSecurityExpressionHandler expressionHandler = new DefaultWebSecurityExpressionHandler();
            expressionHandler.setRoleHierarchy(authorities -> {
                String[] allAlertRoles = retrieveAllowedRoles();
                return AuthorityUtils.createAuthorityList(allAlertRoles);
            });
            webExpressionVoter.setExpressionHandler(expressionHandler);
            affirmativeBased.getDecisionVoters().add(webExpressionVoter);
            return affirmativeBased;
        }
    };
}

Example 3 with DefaultWebSecurityExpressionHandler

use of org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler in project syncope by apache.

the class DefaultRolesPrefixPostProcessor method postProcessAfterInitialization.

@Override
public Object postProcessAfterInitialization(final Object bean, final String beanName) {
    if (bean instanceof DefaultMethodSecurityExpressionHandler) {
        ((DefaultMethodSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if (bean instanceof DefaultWebSecurityExpressionHandler) {
        ((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
    }
    if (bean instanceof SecurityContextHolderAwareRequestFilter) {
        SecurityContextHolderAwareRequestFilter filter = (SecurityContextHolderAwareRequestFilter) bean;
        filter.setRolePrefix(StringUtils.EMPTY);
        try {
            filter.afterPropertiesSet();
        } catch (ServletException e) {
            throw new FatalBeanException(e.getMessage(), e);
        }
    }
    return bean;
}

Example 4 with DefaultWebSecurityExpressionHandler

use of org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler in project spring-security by spring-projects.

the class ExpressionUrlAuthorizationConfigurer method getExpressionHandler.

private SecurityExpressionHandler<FilterInvocation> getExpressionHandler(H http) {
    if (this.expressionHandler != null) {
        return this.expressionHandler;
    }
    DefaultWebSecurityExpressionHandler defaultHandler = new DefaultWebSecurityExpressionHandler();
    AuthenticationTrustResolver trustResolver = http.getSharedObject(AuthenticationTrustResolver.class);
    if (trustResolver != null) {
        defaultHandler.setTrustResolver(trustResolver);
    }
    ApplicationContext context = http.getSharedObject(ApplicationContext.class);
    if (context != null) {
        String[] roleHiearchyBeanNames = context.getBeanNamesForType(RoleHierarchy.class);
        if (roleHiearchyBeanNames.length == 1) {
            defaultHandler.setRoleHierarchy(context.getBean(roleHiearchyBeanNames[0], RoleHierarchy.class));
        }
        String[] grantedAuthorityDefaultsBeanNames = context.getBeanNamesForType(GrantedAuthorityDefaults.class);
        if (grantedAuthorityDefaultsBeanNames.length == 1) {
            GrantedAuthorityDefaults grantedAuthorityDefaults = context.getBean(grantedAuthorityDefaultsBeanNames[0], GrantedAuthorityDefaults.class);
            defaultHandler.setDefaultRolePrefix(grantedAuthorityDefaults.getRolePrefix());
        }
        String[] permissionEvaluatorBeanNames = context.getBeanNamesForType(PermissionEvaluator.class);
        if (permissionEvaluatorBeanNames.length == 1) {
            PermissionEvaluator permissionEvaluator = context.getBean(permissionEvaluatorBeanNames[0], PermissionEvaluator.class);
            defaultHandler.setPermissionEvaluator(permissionEvaluator);
        }
    }
    this.expressionHandler = postProcess(defaultHandler);
    return this.expressionHandler;
}

Example 5 with DefaultWebSecurityExpressionHandler

use of org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler in project spring-security by spring-projects.

the class AbstractAuthorizeTagTests method expressionFromChildContext.

@Test
@SuppressWarnings("rawtypes")
public void expressionFromChildContext() throws IOException {
    SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken("user", "pass", "USER"));
    DefaultWebSecurityExpressionHandler expected = new DefaultWebSecurityExpressionHandler();
    this.tag.setAccess("permitAll");
    WebApplicationContext wac = mock(WebApplicationContext.class);
    given(wac.getBeansOfType(SecurityExpressionHandler.class)).willReturn(Collections.<String, SecurityExpressionHandler>singletonMap("wipe", expected));
    this.servletContext.setAttribute("org.springframework.web.servlet.FrameworkServlet.CONTEXT.dispatcher", wac);
    assertThat(this.tag.authorize()).isTrue();
}