Spring security using model properties to apply roles

Question

I have a Spring MVC app which I wish to integrate Spring Security with (Spring 3.0.x).

web.xml contains:


    Context Configuration locations for Spring XML files
    contextConfigLocation
    
        classpath*:spring/spring-model.xml
        classpath*:spring/spring-compiler.xml
        classpath*:spring/spring-ui.xml
        classpath*:spring/spring-security.xml
    


    
    org.springframework.web.context.ContextLoaderListener


    Configuration for the Spring MVC webapp servlet
    springmvc
    org.springframework.web.servlet.DispatcherServlet
    
        contextConfigLocation
        classpath*:spring/spring-mvc.xml
    


    springmvc
    /app/*

I would like to add role-based security so that users can't access certain parts of the site.

e.g. a user should have the role CRICKET_USER to be able to access http://example.com/sports/cricket and the role FOOTBALL_USER to access http://example.com/sports/football.

The URIs in the application retain this hierarchy, so there might be resources such as http://example.com/sports/football/leagues/premiership which should similarly require the user to have the role FOOTBALL_USER.

I have a controller like so:

@Controller("sportsController")
@RequestMapping("/sports/{sportName}")
public class SportsController {

    @RequestMapping("")
    public String index(@PathVariable("sportName") Sport sport, Model model) {
        model.addAttribute("sport", sport);
        return "sports/index";
    }

}

I've been trying to use the most idiomatic, obvious way to fulfil this requirement, but I'm not sure I've found it yet. I've tried 4 different approaches.

@PreAuthorize annotation

I've tried to use @PreAuthorize("hasRole(#sportName.toUpperCase() + '_USER')") on each @RequestMapping method on that controller (and other controllers which handle URI requests further down the hierarchy. I haven't been able to get that working; no error, but it doesn't seem to do anything.

Bad points:

Doesn't work?
Method-level annotation, rather than class level, on the @Controller. That isn't very DRY. Plus there is the potential for leaving a security hole if more functionality gets added and someone forgets to add the annotation to the new code.
I can't write a test for it.

Intercept-url in Spring Security chain

This feels like it should work, would be obvious to other developers as to what it's doing but I've not been successful with this approach. My only pain-point with this approach is not being able to write a test that will flag a problem if something changes down the road.

java.lang.IllegalArgumentException: Failed to evaluate expression 'hasRole(#sportName.toUpper() + '_USER')'
at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:13)
at org.springframework.security.web.access.expression.WebExpressionVoter.vote(WebExpressionVoter.java:34)
...
Caused by: 
org.springframework.expression.spel.SpelEvaluationException: EL1011E:(pos 17): Method call: Attempted to call method toUpper() on null context object
at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:69)
at org.springframework.expression.spel.ast.CompoundExpression.getValueInternal(CompoundExpression.java:57)

Standard Filter in the Spring Security chain.

public class SportAuthorisationFilter extends GenericFilterBean {

    /**
     * {@inheritDoc}
     */
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;

        String pathInfo = httpRequest.getPathInfo();

        /* This assumes that the servlet is coming off the /app/ context and sports are served off /sports/ */
        if (pathInfo.startsWith("/sports/")) {

            String sportName = httpRequest.getPathInfo().split("/")[2];

            List roles = SpringSecurityContext.getRoles();

            if (!roles.contains(sportName.toUpperCase() + "_USER")) {
                throw new AccessDeniedException(SpringSecurityContext.getUsername()
                        + "is  not permitted to access sport " + sportName);
            }
        }

        chain.doFilter(request, response);
    }
}

and:

Plus points:

This works

Bad points:

No tests.
Potentially fragile if our application URI structure changes.
Not obvious to the next guy that comes to change the code.

Validate in the Formatter implementation used by @PathVariable

@Component
public class SportFormatter implements DiscoverableFormatter {

@Autowired
private SportService SportService;

public Class getTarget() {
    return Sport.class;
}

public String print(Sport sport, Locale locale) {
    if (sport == null) {
        return "";
    }
    return sport.getName();
}

public Sport parse(String text, Locale locale) throws ParseException {
    Sport sport;

    if (text == null || text.isEmpty()) {
        return new Sport();
    }

    if (NumberUtils.isNumber(text)) {
        sport = sportService.getByPrimaryKey(new Long(text));
    } else {
        Sport example = new Sport();
        example.setName(text);
        sport = sportService.findUnique(example);
    }

    if (sport != null) {
        List roles = SpringSecurityContext.getRoles();

        if (!roles.contains(sportName.toUpperCase() + "_USER")) {
            throw new AccessDeniedException(SpringSecurityContext.getUsername()
                    + "is  not permitted to access sport " + sportName);
        }      
    }

    return sport != null ? sport : new Sport();
    }
}

Plus points:

This works.

Bad points:

Does this rely on every @RequestMapping annotated method in the controllers having a @PathVariable which retrieves the Sport instance?
No tests.

Please point out which part of the fine manual I'm missing.

axtavt · Accepted Answer

Instead of #sportName.toUpper() you need to use something like #sport.name.toUpper(), because #... variables in @PreAuthorize refer to method arguments:

@RequestMapping(...)
@PreAuthorize("hasRole(#sport.name.toUpper() + '_USER')") 
public String index(@PathVariable("sportName") Sport sport, Model model) { ... }

See also:

15.3.1 @Pre and @Post Annotations

Spring security using model properties to apply roles

@PreAuthorize annotation

Intercept-url in Spring Security chain

Standard Filter in the Spring Security chain.

Validate in the Formatter implementation used by @PathVariable

Answers (2)

Related Questions