Dynamic Spring Security using SQL Query

Question

Hello I want to make an intercept url pattern and access dynamically by using sql query in spring security.

Generally we use this type of notation in XML and I want to take these values (/add-role and ROLE_ADMIN) from database.

<intercept-url pattern="/add-role*" access="ROLE_ADMIN" />

Is it possible to do this dynamically?

Answer 1

I have created this entry for update purpose

Implement Custom FilterInvocationSecurityMetadataSource

This class only obtains the URL in every request and lookup their permissions from the database or third party applications

public class CommonFilterSecurityMetaDataSource implements FilterInvocationSecurityMetadataSource {

private final Map<String, UrlRequestModel> permissions;

@Autowired
private UrlRequestDao urlRequestDao;

public CommonFilterSecurityMetaDataSource() {
    permissions = new Hashtable<>();
}

public List<ConfigAttribute> getAttributes(Object object) {
    final FilterInvocation fi = (FilterInvocation) object;
    final String url = fi.getRequestUrl();
    final String httpMethod = fi.getRequest().getMethod();
    final String key = String.format("%s %s", httpMethod, url);
    final UrlRequestModel urlRequestModel;

    List<ConfigAttribute> attributes = null;

    // Lookup your database (or other source) using this information and populate the
    // list of attributes
    if(permissions.containsKey(key)) {
        urlRequestModel= permissions.get(key);
    } else {
        urlRequestModel= catRequestDao.findByUrl(url);
        if(catRequestMapModel != null) {
            permissions.put(key, urlRequestModel);
        }
    }


    if (catRequestMapModel != null) {
        List<RoleModel> roles = ulrRequestModel.getRoleList();
        if(!roles.isEmpty()) {
            attributes = new ArrayList<>(roles.size());
            for (RoleModel role : roles) {
                attributes.add(new SecurityConfig(role.getDescription()));
            }
        }
    }



    return attributes;
}

public Collection<ConfigAttribute> getAllConfigAttributes() {
    return null;
}

public boolean supports(Class<?> clazz) {
    return FilterInvocation.class.isAssignableFrom(clazz);
}
}

Java configuration

For java configuration only add this to your class wich extends from WebSecurityConfigurerAdapter

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.headers().frameOptions().disable();
    http.authorizeRequests().
            antMatchers( "/javax.faces.resource/**").permitAll().
            and()
            .exceptionHandling().accessDeniedPage("/accessDenied.jsf").
            and().formLogin().
            loginPage("/login.jsf").
            loginProcessingUrl("/loginAction").
            usernameParameter("app_username").
            passwordParameter("app_password").
            defaultSuccessUrl("/secure/index.jsf").
            and().logout().
            logoutUrl("/appLogout").
            logoutSuccessUrl("/login.jsf").logoutRequestMatcher(new AntPathRequestMatcher("/appLogout")).
            and().addFilterAfter(filterSecurityInterceptor(), FilterSecurityInterceptor.class);
    http.csrf().disable();

}
@Bean
public FilterSecurityInterceptor filterSecurityInterceptor() throws Exception {
    FilterSecurityInterceptor filterSecurityInterceptor = new FilterSecurityInterceptor();
    filterSecurityInterceptor.setSecurityMetadataSource(securityMetadataSource());
    filterSecurityInterceptor.setAuthenticationManager(authenticationManager());
    filterSecurityInterceptor.setAccessDecisionManager(accessDecisionManager());
    filterSecurityInterceptor.setPublishAuthorizationSuccess(true);
    return filterSecurityInterceptor;
}


@Bean
public AccessDecisionManager accessDecisionManager() {
    AuthenticatedVoter authenticatedVoter = new AuthenticatedVoter();
    RoleVoter roleVoter = new RoleVoter();
    List<AccessDecisionVoter<? extends Object>> voters = new ArrayList<>();
    voters.add(authenticatedVoter);
    voters.add(roleVoter);
    return new AffirmativeBased(voters);
}

@Bean
public FilterInvocationSecurityMetadataSource securityMetadataSource() {
    return new CommonFilterSecurityMetaDataSource();
}

I tested it using Spring security 5.0.8

Answer 2

Disclaimer

As the Spring Security FAQ mentions, the first thing you should do is ask should I really do this? Security is complicated and the configuration should be tested extensively. Allowing the configuration to change dynamically only further complicates things making the application that much more vulnerable. If you really want to do this, the FAQ outlines a basic method to accomplish this. I have expanded upon the FAQ's answer below.

Implement Custom FilterInvocationSecurityMetadataSource

To obtain the security URL mappings dynamically you can implement your own FilterInvocationSecurityMetadataSource. An example implementation is given below.

NOTE: Keep in mind that getAttributes will be invoked for every request that Spring Security intercepts so you will most likely want some sort of caching.

public class JdbcFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {

    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        FilterInvocation fi = (FilterInvocation) object;

        String url = fi.getRequestUrl();
        HttpServletRequest request = fi.getHttpRequest();

        // Instead of hard coding the roles lookup the roles from the database using the url and/or HttpServletRequest
        // Do not forget to add caching of the lookup   
        String[] roles = new String[] { "ROLE_ADMIN", "ROLE_USER" };
        return SecurityConfig.createList(roles);
    }

    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    public boolean supports(Class<?> clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
    }
}

Create a BeanPostProcessor

You cannot use the namespace to wire it up, so taking another tip from the FAQ you can use a BeanPostProcessor which might look like:

public class FilterInvocationSecurityMetadataSourcePostProcessor implements BeanPostProcessor, InitializingBean {
    private FilterInvocationSecurityMetadataSource securityMetadataSource;

    public Object postProcessAfterInitialization(Object bean, String name) {
        if (bean instanceof FilterSecurityInterceptor) {
            ((FilterSecurityInterceptor)bean).setSecurityMetadataSource(securityMetadataSource);
        }
        return bean;
    }

    public Object postProcessBeforeInitialization(Object bean, String name) {
        return bean;
    }

    public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {
        this.securityMetadataSource = securityMetadataSource;
    }

    public void afterPropertiesSet() throws Exception {
        Assert.notNull(securityMetadataSource,"securityMetadataSource cannot be null");
    }
}

XML Configuration

Then, assuming both of the above beans are in the package sample, you would add the following configuration

<bean class="sample.FilterInvocationSecurityMetadataSourcePostProcessor">
    <property name="securityMetadataSource">
        <bean class="sample.JdbcFilterInvocationSecurityMetadataSource"/>
    </property>
</bean>

Possible Problems

If you end up getting a ClassCastException, you are likely running into SEC-1957 which was fixed in Spring Security 3.1.1+ Try updating to the latest version to resolve this.

Answer 3

You cant really get those values from the databse, but you can write a custom code called DecisionManager that evaluates if the resource is allowed to execute. With that code you can even read data from the database.

<bean id="MyDecisionManagerBean" class="org.springframework.security.vote.UnanimousBased">
    <property name="decisionVoters">
        <list>
            <!-- <bean class="org.springframework.security.vote.RoleVoter"/>  -->
            <bean class="org.springframework.security.vote.RoleHierarchyVoter" >
                 <constructor-arg>
                  <bean class="org.springframework.security.userdetails.hierarchicalroles.RoleHierarchyImpl" factory-bean="roleHierarchyImplFactory" factory-method="createRoleHierarchyImpl"/>
                </constructor-arg>  
            </bean>
            <bean class="com.mycompany.RoleDenyVoter"/>
            <bean class="com.mycompany.RoleAllowVoter"/>
        </list>
    </property>
</bean> 

Your class will be like this :

public class RoleDenyVoter implements AccessDecisionVoter {

    public int vote(Authentication authentication, Object object, ConfigAttributeDefinition config) {
         //read from the DB and decide if access is granted

the process is documented here :

http://static.springsource.org/spring-security/site/docs/3.0.x/reference/authz-arch.html#authz-voting-based