Class MethodSecurityMetadataSourceAdvisor

java.lang.Object
org.springframework.aop.support.AbstractPointcutAdvisor
org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor
All Implemented Interfaces:
Serializable, org.springframework.aop.Advisor, org.springframework.aop.PointcutAdvisor, org.springframework.beans.factory.Aware, org.springframework.beans.factory.BeanFactoryAware, org.springframework.core.Ordered

public class MethodSecurityMetadataSourceAdvisor extends org.springframework.aop.support.AbstractPointcutAdvisor implements org.springframework.beans.factory.BeanFactoryAware
Advisor driven by a MethodSecurityMetadataSource, used to exclude a MethodInterceptor from public (non-secure) methods.

Because the AOP framework caches advice calculations, this is normally faster than just letting the MethodInterceptor run and find out itself that it has no work to do.

This class also allows the use of Spring's DefaultAdvisorAutoProxyCreator, which makes configuration easier than setup a ProxyFactoryBean for each object requiring security. Note that autoproxying is not supported for BeanFactory implementations, as post-processing is automatic only for application contexts.

Based on Spring's TransactionAttributeSourceAdvisor.

See Also:
  • Field Summary

    Fields inherited from interface org.springframework.aop.Advisor

    EMPTY_ADVICE

    Fields inherited from interface org.springframework.core.Ordered

    HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE
  • Constructor Summary

    Constructors
    Constructor
    Description
    MethodSecurityMetadataSourceAdvisor(String adviceBeanName, MethodSecurityMetadataSource attributeSource, String attributeSourceBeanName)
    Alternative constructor for situations where we want the advisor decoupled from the advice.
  • Method Summary

    Modifier and Type
    Method
    Description
    org.aopalliance.aop.Advice
     
    org.springframework.aop.Pointcut
     
    void
    setBeanFactory(org.springframework.beans.factory.BeanFactory beanFactory)
     

    Methods inherited from class org.springframework.aop.support.AbstractPointcutAdvisor

    equals, getOrder, hashCode, isPerInstance, setOrder

    Methods inherited from class java.lang.Object

    clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait
  • Constructor Details

    • MethodSecurityMetadataSourceAdvisor

      public MethodSecurityMetadataSourceAdvisor(String adviceBeanName, MethodSecurityMetadataSource attributeSource, String attributeSourceBeanName)
      Alternative constructor for situations where we want the advisor decoupled from the advice. Instead the advice bean name should be set. This prevents eager instantiation of the interceptor (and hence the AuthenticationManager). See SEC-773, for example. The metadataSourceBeanName is used rather than a direct reference to support serialization via a bean factory lookup.
      Parameters:
      adviceBeanName - name of the MethodSecurityInterceptor bean
      attributeSource - the SecurityMetadataSource (should be the same as the one used on the interceptor)
      attributeSourceBeanName - the bean name of the attributeSource (required for serialization)
  • Method Details

    • getPointcut

      public org.springframework.aop.Pointcut getPointcut()
      Specified by:
      getPointcut in interface org.springframework.aop.PointcutAdvisor
    • getAdvice

      public org.aopalliance.aop.Advice getAdvice()
      Specified by:
      getAdvice in interface org.springframework.aop.Advisor
    • setBeanFactory

      public void setBeanFactory(org.springframework.beans.factory.BeanFactory beanFactory) throws org.springframework.beans.BeansException
      Specified by:
      setBeanFactory in interface org.springframework.beans.factory.BeanFactoryAware
      Throws:
      org.springframework.beans.BeansException