Issues Configuring Spring Method Level Security (Annotations)

I this post, I am going to discuss about some issues that I faced while configuring method level security with
Annotation like @PreAuthorize, @PostAuthorize etc.

The scenario is that I am trying to secure the calls to my controller methods through Annotation Based Method level
security of Spring Security module.

One of the parameters of the @PreAuthorize is the method parameter of Spring controller which I am passing with the
help of Expression language and the parameter is being confugured through WebArgumentResolver of Spring as discussed in my previous post.

@PreAuthorize("hasPriviledge(#dataInj,'TxnClm5013','read')")
 @RequestMapping(value="/SecureMethodNew" , method=RequestMethod.GET)
 public ModelAndView secureMethodNew(HttpServletRequest request,@DataInject("dataInject") String dataInject123,@DataInjectNew DataInjectObject dataInj) throws Exception
 {
I am going to discuss my discussion into two sections:
Section 1:
When the controller is not implementing any interface.
Now in this case I have faced two issues.
a) The value of the parameter which is being configured through WebArgumentResolver, is not reflected in the @PreAuthorize
process after passing it through # operator i.e. Expression Language.
b) The @PreAuthorize is not being invoked in spite of all having configurations in order.
c) AccessDeniedHandler is not getting invoked when @PreAuthorize returns false.
The reason for Problem (a) is when me compile a java file, the corresponding class file do not have parameter name
in it only parameter Type and order is there in class file hence mapping through ASM api(which does the byte code encoding) is not possible and so
no value is being populated.

But when we compile a java file with debug on option i.e. dubug attribute true for ANT and in Maven compile
debug is on by default then the method parameter names get stored in LocalAttributeTable and hence it is getting mapped and appropiated
value is being populated.

Now to resolve problem (b) we need some insight regarding how method level Annotation
in Spring Security works. When the class in which method level security is to be configured does not implement any type then
Spring uses its own AOP along with JDK based dynamic proxy for proxying more details are present in my post Annotation Based Method Level Security Handler Now element which does all the magic should be defined in same Application Context
as of the configured bean in whose method, Method level Secrity is to be applied

Lastly for Problem (c), since in my application I have modified Spring Security method level security
feature with custom needs, without fully implementing the Spring Security so there is no Authentication Object for my current logged in User
and User Login is not configured with Spring.

So when from Method level security @PreAuthorize is returning false, an AccessDenied Exception is
being thrown, which is being caught by ExceptionTranslationFilter, which does the following:

1) If the user is Authenticated (There is Authentication Token in the SecurityContext) then, the configured
AccessDeniedHandler is called.

2) If the user is not Authenticated (which is my case) then the request is being forwarded to AuthenticationEntryPoint
so the configured Access Denied Handler is not getting invoked.

So, what I did is, I configured a custom filter and caught that Exception out there and from its catch
block I called directly the AccessDeniedHandler.

Section 2:

When the controller is implementing interface.

In this case implemetation of Method Level Security through annotation is being done through AspectJ with the
help of CGLIB proxy not with Spring AOP. In this mode some additional configurations are being required in
element i.e. mode="AspectJ" and proxy-target-class="true", this two attributes. Along with this some additional jars like AspectJweaver.jar
and others are required. During copilation of java classes in this case compilation with aspectJ i.e. compile time weaving is
reqired to be carried out, which is already being metioned in my previous post Aspects of AspectJ

Comments

Post a Comment

Popular posts from this blog

Use of @Configurable annotation.

Not, all types(beans) used in a Spring Based Application are Spring managed. Sometimes, we need to inject some dependency into some Types which are not Spring Managed. The most common example being, injection of Service or DAO layer within the Entity class. Now the instances of Entity classes are being created using the new operator, i.e. they are not Spring Managed. Now we want to inject the corresponding Service or DAO Type which is Spring Managed within these Entity Types, and these can be performed with the help of @Configurable . It is the Aspects, which performs all the underlying engineering and ,makes this thing possible. Let's see an example. @Configurable public class Person { @Autowired ResourceBundleThemeSource themeSource; private String firstName; private String lastName; private int age; private Address address; @CustomDateFormat Date birthDate; MultipartFile profile; public String getFirstName() { return firstName; } public voi...
Read more

Spring WS - Part 5

Spring WS provides an easy integration with various WS-Security features with the help of interceptors like Wss4jSecurityInterceptor, XwsjSecurityInterceptor. We are going to explore here very basic feature of WS-SECURITY i.e. implementing Security using with UserNameTokenAuthentication We are going to use Wss4jSecurityInterceptor as it is very easy to configure. We are going to use configure two interceptors: 1) One for the Server End. 2) Other for the Client End. For Server End The configuration for Wss4jSecurityInterceptor is as follows: @Bean public Wss4jSecurityInterceptor wss4jSecurityInterceptor() { /** * The SecurementActions for UsernameToken is commented, as the * UsernameToken is to be added by the client, the server-side * interceptor would only validate that. * */ Wss4jSecurityInterceptor wss4jSecurityInterceptor = new Wss4jSecurityInterceptor(); wss4jSecurityInterceptor.setValidationActions("UsernameToken"); ...
Read more

Spring WS - Part 4

Another interesting and essential feature is the attachment part. Now I found two things out here. The attachment can be inline within the SOAP message body (suitable as long as the attachment size is not too long) or we can enable MTOM feature within the marshaller and leverage the MTOM-XOP feature. For the attachment to be inline with the SOAP message body, no actual configuration are required, everything is being taken care by the Spring WS framework, except the following: &ltxs:element name="getCountryRequest"&gt &ltxs:complexType&gt &ltxs:sequence&gt &ltxs:element name="name" type="xs:string"/&gt &ltxs:element name="file" type="xs:base64Binary" xmime:expectedContentTypes="application/octet-stream"&gt&lt/xs:element&gt &lt/xs:sequence&gt &lt/xs:complexType&gt &lt/xs:e...
Read more