Class AuthorizationAdvisorProxyFactory
- All Implemented Interfaces:
Iterable<AuthorizationAdvisor>
,org.springframework.aop.framework.AopInfrastructureBean
,AuthorizationProxyFactory
For example, consider a non-Spring-managed object Foo
:
class Foo { @PreAuthorize("hasAuthority('bar:read')") String bar() { ... } }Use
AuthorizationAdvisorProxyFactory
to wrap the instance in Spring Security's
PreAuthorize
method interceptor
like so:
AuthorizationProxyFactory proxyFactory = AuthorizationAdvisorProxyFactory.withDefaults(); Foo foo = new Foo(); foo.bar(); // passes Foo securedFoo = proxyFactory.proxy(foo); securedFoo.bar(); // access denied!
- Since:
- 6.3
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionstatic interface
An interface to handle how theAuthorizationAdvisorProxyFactory
should step through the target's object hierarchy. -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionvoid
addAdvisor
(AuthorizationAdvisor advisor) Add an advisor that should be included to each proxy created.iterator()
Proxy an object to enforce authorization advice.void
setAdvisors
(Collection<AuthorizationAdvisor> advisors) Deprecated.void
setAdvisors
(AuthorizationAdvisor... advisors) Deprecated.void
Use this visitor to navigate the proxy target's hierarchy.Construct anAuthorizationAdvisorProxyFactory
with the defaults needed for wrapping objects in Spring Security's pre-post method security support.Construct anAuthorizationAdvisorProxyFactory
with the defaults needed for wrapping objects in Spring Security's pre-post reactive method security support.Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
Methods inherited from interface java.lang.Iterable
forEach, spliterator
-
Constructor Details
-
AuthorizationAdvisorProxyFactory
Construct anAuthorizationAdvisorProxyFactory
with the provided advisors.The list may be empty, in the case where advisors are added later using
addAdvisor(org.springframework.security.authorization.method.AuthorizationAdvisor)
.- Parameters:
advisors
- the advisors to use- Since:
- 6.4
-
-
Method Details
-
withDefaults
Construct anAuthorizationAdvisorProxyFactory
with the defaults needed for wrapping objects in Spring Security's pre-post method security support.- Returns:
- an
AuthorizationAdvisorProxyFactory
for adding pre-post method security support
-
withReactiveDefaults
Construct anAuthorizationAdvisorProxyFactory
with the defaults needed for wrapping objects in Spring Security's pre-post reactive method security support.- Returns:
- an
AuthorizationAdvisorProxyFactory
for adding pre-post reactive method security support
-
proxy
Proxy an object to enforce authorization advice.Proxies any instance of a non-final class or a class that implements more than one interface.
If
target
is anIterator
,Collection
,Array
,Map
,Stream
, orOptional
, then the element or value type is proxied.If
target
is aClass
, thenProxyFactory.getProxyClass(java.lang.ClassLoader)
is invoked instead.- Specified by:
proxy
in interfaceAuthorizationProxyFactory
- Parameters:
target
- the instance to proxy- Returns:
- the proxied instance
-
setAdvisors
Deprecated.Add advisors that should be included to each proxy created.All advisors are re-sorted by their advisor order.
- Parameters:
advisors
- the advisors to add
-
setAdvisors
Deprecated.Add advisors that should be included to each proxy created.All advisors are re-sorted by their advisor order.
- Parameters:
advisors
- the advisors to add
-
addAdvisor
Add an advisor that should be included to each proxy created.This method sorts the advisors based on the order in
Ordered.getOrder()
. You can use the values inAuthorizationInterceptorsOrder
to ensure advisors are located where you need them.- Parameters:
advisor
-- Since:
- 6.4
-
setTargetVisitor
Use this visitor to navigate the proxy target's hierarchy.This can be helpful when you want a specialized behavior for a type or set of types. For example, if you want to have this factory skip primitives and wrappers, then you can do:
AuthorizationAdvisorProxyFactory proxyFactory = new AuthorizationAdvisorProxyFactory(); proxyFactory.setTargetVisitor(TargetVisitor.defaultsSkipValueTypes());
The default
AuthorizationAdvisorProxyFactory.TargetVisitor
proxiesClass
instances as well as instances contained in reactive types (if reactor is present), collection types, and other container types likeOptional
andSupplier
.If you want to add support for another container type, you can do so in the following way:
TargetVisitor functions = (factory, target) -> { if (target instanceof Function function) { return (input) -> factory.proxy(function.apply(input)); } return null; }; AuthorizationAdvisorProxyFactory proxyFactory = new AuthorizationAdvisorProxyFactory(); proxyFactory.setTargetVisitor(TargetVisitor.of(functions, TargetVisitor.defaultsSkipValueTypes()));
- Parameters:
visitor
- the visitor to use to introduce specialized behavior for a type- See Also:
-
iterator
- Specified by:
iterator
in interfaceIterable<AuthorizationAdvisor>
-
addAdvisor(org.springframework.security.authorization.method.AuthorizationAdvisor)
instead