4

I want to use @PreAuthorize annotation on service methods with Spring Security. One of requirements is to use role-hierarchy. But by default it is not enabled.

I found that in SecurityExpressionRoot class ("the base class for expression root objects") there is a property roleHierarchy. The class actually does use this property for methods like hasRole() and hasAnyRole().

I suppose that if I supply it with my own RoleHierarchy bean I will be able to use @PreAuthorize annotations with hierarchical roles.

How can I inject my hierarchy bean into SecurityExpressionRoot?

Aleksey Otrubennikov
  • 1,121
  • 1
  • 12
  • 26

1 Answers1

7

For method security you can set RoleHierarchy as a property of DefaultMethodSecurityExpressionHandler, something like this:

<global-method-security ...>
    <expression-handler ref = "methodSecurityExpressionHandler" />
</global-method-security>

<beans:bean id = "methodSecurityExpressionHandler" 
    class = "org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
    <beans:property name = "roleHierarchy" .../>
</beans:bean>
axtavt
  • 239,438
  • 41
  • 511
  • 482