8

I am trying to integrate Spring Security in my spring web application. Basically I need to hide some menus based on user permission. Here is what I did.

I added below JARS in classpath.

spring-security-acl-4.0.2.RELEASE.jar
spring-security-config-4.0.2.RELEASE.jar
spring-security-core-4.0.2.RELEASE.jar
spring-security-taglibs-4.0.1.RELEASE.jar
spring-security-web-4.0.2.RELEASE.jar

Below are the entries in web.xml

<context-param>
    <param-name>log4jConfiguration</param-name>
    <param-value>/WEB-INF/web_log4j.xml</param-value>
</context-param>

<listener>
    <listener-class>org.apache.logging.log4j.web.Log4jServletContextListener</listener-class>
</listener>

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring-root.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

I wrote a class CustomPermissionEvaluator like below.

public class CustomPermissionEvaluator implements PermissionEvaluator{


@Override
public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
    HttpServletRequest request = (HttpServletRequest) targetDomainObject;
    Profile userProfile = (Profile) request.getSession().getAttribute("testprofile");
    if (userProfile.getPermissionMap().get(String.valueOf(permission)) != null) {
        return true;
    } else {
        return false;
    }
}

@Override
public boolean hasPermission(Authentication arg0, Serializable arg1,
        String arg2, Object arg3) {
    // TODO Auto-generated method stub
    return false;
}

}

After this I wrote SecurityConfig file.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Override
public void configure(WebSecurity web) throws Exception {
    DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
    handler.setPermissionEvaluator(new CustomPermissionEvaluator());
    web.expressionHandler(handler);
}

}

I have below entries in my spring-root.xml

<sec:global-method-security pre-post-annotations="enabled">
    <sec:expression-handler ref="expressionHandler" />
</sec:global-method-security>
<bean id="expressionHandler"
    class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
    <property name="permissionEvaluator" ref="permissionEvaluator" />
</bean>
<bean id="permissionEvaluator" class="main.java.com.config.CustomPermissionEvaluator" />

Now in my JSP file I am using below taglib.

and below code

<sec:authorize access="hasPermission('cadastra_categoria', #request)">      
                <div id="TEST">
                </div>
            </sec:authorize>

But it is not working. Any suggesation will be appreciated.

10
  • Is there an indicator, error or something? Does the hasPermission call reached the implementation when you place a breakpoint? I think you are missing the security filterchain docs.spring.io/spring-security/site/docs/4.2.3.RELEASE/… but its an assumption
    – David
    Aug 25, 2017 at 9:30
  • No, neither I am getting any error nor call reaching to CustomPermissionEvaluator .
    – GD_Java
    Aug 25, 2017 at 9:33
  • Are you sure you are referencing your bean correctly? class="main.java.com.config.CustomPermissionEvaluator" - shouldn't this be without main.java?
    – alturkovic
    Aug 28, 2017 at 11:31
  • @aturkovic yes I am referring my bean correctly. That is how project is.
    – GD_Java
    Aug 28, 2017 at 11:34
  • Have you tried adding some logging to see if your evaluation is really called? Also, some logging for debugging and to see if you encounter any exception?
    – N4zroth
    Aug 28, 2017 at 12:47

3 Answers 3

2
+25

"hasPermission('cadastra_categoria', #request)"

Actually, valid call has to have arguments swapped, first one must be target domain object and second - permission:

hasPermission(#request, 'cadastra_categoria')

I assume you also double-checked you've imported sec taglib to your JSP as required

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

And finally as clarified in 2-nd part of this answer, define the following:

import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;

public class AnnotationConfigDispatcherServletInitializer extends
    AbstractAnnotationConfigDispatcherServletInitializer {

  @Override
  protected Class<?>[] getRootConfigClasses() {
    return new Class[] {
      SecurityConfig.class //your SecurityConfig
    };
  }
}

to make sure configure(WebSecurity web) is called during your web application startup

1
  • Leave it guys I solved my problem yesterday and will update with solution. Thanks for help.
    – GD_Java
    Aug 29, 2017 at 7:34
2

As i understand your question you have created CustomPermissionEvaluator class but you are not checking with your Authenticated user permission.

I am directly writing the code CustomPermissionEvaluator for clear my point there might be any error:

public class CustomPermissionEvaluator implements PermissionEvaluator {

    public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) {
        if ((auth == null) || (targetDomainObject == null) || !(permission instanceof String)){
            return false;
        }

        Profile userProfile = (Profile) request.getSession().getAttribute("testprofile");
        String targetType = userProfile.getPermissionMap().get(String.valueOf(permission));

        return hasPrivilege(auth, targetType, permission.toString().toUpperCase());
    }

    private boolean hasPrivilege(Authentication auth, String targetType, String permission) {
        for (GrantedAuthority grantedAuth : auth.getAuthorities()) {
            if (grantedAuth.getAuthority().startsWith(targetType)) {
                if (grantedAuth.getAuthority().contains(permission)) {
                    return true;
                }
            }
        }
        return false;
    }

    @Override
    public boolean hasPermission(Authentication arg0, Serializable arg1, String arg2, Object arg3) {
        // TODO Auto-generated method stub
        return false;
    }
}
0

Please try hasAnyRole and check once i.e

<sec:authorize access="hasAnyRole('ROLE_NAME')"> TEST </sec:authorize>
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.