public class OAuth2SecurityExpressionMethods extends Object
Constructor and Description |
---|
OAuth2SecurityExpressionMethods(org.springframework.security.core.Authentication authentication) |
Modifier and Type | Method and Description |
---|---|
boolean |
clientHasAnyRole(String... roles)
Check if the OAuth2 client (not the user) has one of the roles specified.
|
boolean |
clientHasRole(String role)
Check if the OAuth2 client (not the user) has the role specified.
|
boolean |
denyOAuthClient()
Deny access to oauth requests, so used for example to only allow web UI users to access a resource.
|
boolean |
hasAnyScope(String... scopes)
Check if the current OAuth2 authentication has one of the scopes specified.
|
boolean |
hasAnyScopeMatching(String... scopesRegex)
Check if the current OAuth2 authentication has one of the scopes matching a specified regex expression.
|
boolean |
hasScope(String scope)
Check if the current OAuth2 authentication has the scope specified.
|
boolean |
hasScopeMatching(String scopeRegex)
Check if the current OAuth2 authentication has one of the scopes matching a specified regex expression.
|
boolean |
isClient()
Check if the current authentication is acting as an authenticated client application not on behalf of a user.
|
boolean |
isOAuth()
Permit access to oauth requests, so used for example to only allow machine clients to access a resource.
|
boolean |
isUser()
Check if the current authentication is acting on behalf of an authenticated user.
|
boolean |
throwOnError(boolean decision)
Check if any scope decisions have been denied in the current context and throw an exception if so.
|
public OAuth2SecurityExpressionMethods(org.springframework.security.core.Authentication authentication)
public boolean throwOnError(boolean decision)
OAuth2MethodSecurityExpressionHandler
or
OAuth2WebSecurityExpressionHandler
.
OAuth2Example usage:
access = "#oauth2.hasScope('read') or (#oauth2.hasScope('other') and hasRole('ROLE_USER'))"Will automatically be wrapped to ensure that explicit errors are propagated rather than a generic error when returning false:
access = "#oauth2.throwOnError(#oauth2.hasScope('read') or (#oauth2.hasScope('other') and hasRole('ROLE_USER'))"N.B. normally this method will be automatically wrapped around all your access expressions. You could use it explicitly to get more control, or if you have registered your own
ExpressionParser
you might need
it.decision
- the existing access decisionInsufficientScopeException
- if the scope is invalid and we the flag is set to throw the exceptionpublic boolean clientHasRole(String role)
clientHasRole(String)
.role
- the role to checkpublic boolean clientHasAnyRole(String... roles)
clientHasAnyRole(String...)
.roles
- the roles to checkpublic boolean hasScope(String scope)
scope
- the scope to checkpublic boolean hasAnyScope(String... scopes)
scopes
- the scopes to checkorg.springframework.security.access.AccessDeniedException
- if the scope is invalid and we the flag is set to throw the exceptionpublic boolean hasScopeMatching(String scopeRegex)
access = "#oauth2.hasScopeMatching('.*_admin:manage_scopes')))"
scopeRegex
- the scope regex to matchpublic boolean hasAnyScopeMatching(String... scopesRegex)
access = "#oauth2.hasAnyScopeMatching('admin:manage_scopes','.*_admin:manage_scopes','.*_admin:read_scopes')))"
scopesRegex
- the scopes regex to matchorg.springframework.security.access.AccessDeniedException
- if the scope is invalid and we the flag is set to throw the exceptionpublic boolean denyOAuthClient()
public boolean isOAuth()
public boolean isUser()
public boolean isClient()
Copyright © 2019. All rights reserved.