SEC-1697: Don't publish authorization success events in AbstractSecurityInterceptor by default.

core/src/main/java/org/springframework/security/access/intercept/AbstractSecurityInterceptor.java

@@ -109,6 +109,7 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
     private boolean alwaysReauthenticate = false;
     private boolean rejectPublicInvocations = false;
     private boolean validateConfigAttributes = true;
+    private boolean publishAuthorizationSuccess = false;
 
     //~ Methods ========================================================================================================
 
@@ -212,7 +213,9 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
             logger.debug("Authorization successful");
         }
 
-        publishEvent(new AuthorizedEvent(object, attributes, authenticated));
+        if (publishAuthorizationSuccess) {
+            publishEvent(new AuthorizedEvent(object, attributes, authenticated));
+        }
 
         // Attempt to run as a different user
         Authentication runAs = this.runAsManager.buildRunAs(authenticated, object, attributes);
@@ -402,6 +405,16 @@ public abstract class AbstractSecurityInterceptor implements InitializingBean, A
         this.messages = new MessageSourceAccessor(messageSource);
     }
 
+    /**
+     * Only {@code AuthorizationFailureEvent} will be published.
+     * If you set this property to {@code true}, {@code AuthorizedEvent}s will also be published.
+     *
+     * @param publishAuthorizationSuccess default value is {@code false}
+     */
+    public void setPublishAuthorizationSuccess(boolean publishAuthorizationSuccess) {
+        this.publishAuthorizationSuccess = publishAuthorizationSuccess;
+    }
+
     /**
      * By rejecting public invocations (and setting this property to <tt>true</tt>), essentially you are ensuring
      * that every secure object invocation advised by <code>AbstractSecurityInterceptor</code> has a configuration