Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix allOf/anyOf Abstain Logic

Browse Source 
Closes gh-13069
This commit is contained in:
Josh Cummings
2023-04-24 14:43:12 -06:00
parent 744b74f4c9
commit 9244989b2e
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/modules/ROOT/pages/migration/servlet/authorization.adoc
View File

@@ -278,6 +278,10 @@ Read on to find the best match for your situation.
If your application uses {security-api-url}org/springframework/security/access/vote/UnanimousBased.html[`UnanimousBased`] with the default voters, you likely need do nothing since unanimous-based is the default behavior with {security-api-url}org/springframework/security/config/annotation/method/configuration/EnableMethodSecurity.html[`@EnableMethodSecurity`].
However, if you do discover that you cannot accept the default authorization managers, you can use `AuthorizationManagers.allOf` to compose your own arrangement.
Note that there is a difference with `allOf`, which is that if all delegates abstain then it grants authorization.
If you must deny authorization when all delegates abstain, please implement a composite {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[`AuthorizationManager`] that takes the set of delegate ``AuthorizationManager``s into account.
Having done that, please follow the details in the reference manual for xref:servlet/authorization/method-security.adoc#jc-method-security-custom-authorization-manager[adding a custom `AuthorizationManager`].
==== I use `AffirmativeBased`