spring security - writing a custom SPEL access expression. Is my approach correct?

Question

I wish to specify an intercept-url pattern like pattern = hasCollege('college1',college2'). For that, I am thinking of the following approach :

a) Configure WebExpressionVoter to use a custom expression handler

<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:property name="decisionVoters">
        <beans:list>
            <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                <beans:property name="expressionHandler" ref="myWebSecurityExpressionHandler"/>
            </beans:bean>
        </beans:list>
    </beans:property>
</beans:bean>
<beans:bean id="myWebSecurityExpressionHandler" class="com.daud.security.EEWebSecurityExpressionHandler"/>

b) Make EEWebSecurityExpressionHandler implement WebSecurityExpressionHandler in the manner of DefaultWebSecurityExpressionHandler and use createEvaluationContext to set a custom root object.

@Override
    public EvaluationContext createEvaluationContext(Authentication authentication, FilterInvocation fi) {
        StandardEvaluationContext ctx = new StandardEvaluationContext();
        SecurityExpressionRoot root = new MyWebSecurityExpressionRoot(authentication, fi);
        root.setTrustResolver(trustResolver);
        root.setRoleHierarchy(roleHierarchy);
        ctx.setRootObject(root);
        return ctx;
    }

c) Make MyWebSecurityExpressionRoot extend WebSecurityExpressionRoot and declare a new method corresponding to the new SPEL expression :

public final boolean hasCollege(String... colleges){
       // logic goes here
    }

Is this the right way of approaching the problem ?

Also discussed [here](http://forum.springsource.org/showthread.php?75331-Configuration-of-Spring-Security-3-0M1-Expression-Handler-bug&p=271798#post271798) and [here](http://stackoverflow.com/questions/6632982/how-to-create-custom-methods-for-use-in-spring-security-expression-language-anno) — nobeh, Apr 10 '12 at 12:19

score 1 · Answer 1 · answered Dec 18 '12 at 21:44

In your spring security config you could just do the following.

<http use-expressions="true">
    <intercept-url pattern="/**" access="isFullyAuthenticated() and principal.college matches 'Duke|USC'"/>

That is assuming that there is a getCollege() method on your pricipal.

spring security - writing a custom SPEL access expression. Is my approach correct?

1 Answers1