Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1245: Add role hierarchy support to expression handlers. Done.

Browse Source
This commit is contained in:
Luke Taylor
2009-09-15 17:17:21 +00:00
parent b531a81176
commit 1c4a809e09
4 changed files with 78 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
core/src/main/java/org/springframework/security/access/expression/SecurityExpressionRoot.java
View File

@@ -1,7 +1,10 @@
package org.springframework.security.access.expression;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
@@ -18,6 +21,9 @@ import org.springframework.security.core.authority.AuthorityUtils;
public abstract class SecurityExpressionRoot {
protected final Authentication authentication;
private AuthenticationTrustResolver trustResolver;
private RoleHierarchy roleHierarchy;
private Set<String> roles;
/** Allows "permitAll" expression */
public final boolean permitAll = true;
@@ -32,17 +38,11 @@ public abstract class SecurityExpressionRoot {
}
public final boolean hasRole(String role) {
for (GrantedAuthority authority : authentication.getAuthorities()) {
if (role.equals(authority.getAuthority())) {
return true;
}
}
return false;
return getAuthoritySet().contains(role);
}
public final boolean hasAnyRole(String... roles) {
Set<String> roleSet = AuthorityUtils.authorityListToSet(authentication.getAuthorities());
Set<String> roleSet = getAuthoritySet();
for (String role : roles) {
if (roleSet.contains(role)) {
@@ -88,4 +88,23 @@ public abstract class SecurityExpressionRoot {
public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
this.trustResolver = trustResolver;
}
public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
this.roleHierarchy = roleHierarchy;
}
private Set<String> getAuthoritySet() {
if (roles == null) {
roles = new HashSet<String>();
List<GrantedAuthority> userAuthorities = authentication.getAuthorities();
if (roleHierarchy != null) {
userAuthorities = roleHierarchy.getReachableGrantedAuthorities(userAuthorities);
}
roles = AuthorityUtils.authorityListToSet(userAuthorities);
}
return roles;
}
}

6
core/src/main/java/org/springframework/security/access/expression/method/DefaultMethodSecurityExpressionHandler.java
View File

@@ -16,6 +16,7 @@ import org.springframework.expression.ExpressionParser;
import org.springframework.expression.spel.standard.SpelExpressionParser;
import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.access.expression.ExpressionUtils;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.core.Authentication;
@@ -37,6 +38,7 @@ public class DefaultMethodSecurityExpressionHandler implements MethodSecurityExp
private PermissionEvaluator permissionEvaluator = new DenyAllPermissionEvaluator();
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
private ExpressionParser expressionParser = new SpelExpressionParser();
private RoleHierarchy roleHierarchy;
public DefaultMethodSecurityExpressionHandler() {
}
@@ -50,6 +52,7 @@ public class DefaultMethodSecurityExpressionHandler implements MethodSecurityExp
MethodSecurityExpressionRoot root = new MethodSecurityExpressionRoot(auth);
root.setTrustResolver(trustResolver);
root.setPermissionEvaluator(permissionEvaluator);
root.setRoleHierarchy(roleHierarchy);
ctx.setRootObject(root);
return ctx;
@@ -141,4 +144,7 @@ public class DefaultMethodSecurityExpressionHandler implements MethodSecurityExp
((MethodSecurityExpressionRoot)ctx.getRootObject().getValue()).setReturnObject(returnObject);
}
public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
this.roleHierarchy = roleHierarchy;
}
}