Spring Security Application Development (19) method-based authorization (iii) AOP

This article describes the use the way AOP is configured to implement method-based authorization.

(1) First Use Spring Security provided by Protect-pointcut to configure.

The Protect-pointcut node configuration accesses the list of roles required for method locks that meet the specified criteria.

<!--using AOP to define method-level access control -<sec:global-method-security>   <Sec:protect-pointcutAccess= "Role_user,role_admin"expression= "Execution (* com.test.service.*.get* (..))"/>   <Sec:protect-pointcutAccess= "Role_admin"expression= "Execution (* com.test.service.*.add* (..))"/>   <Sec:protect-pointcutAccess= "Role_admin"expression= "Execution (* com.test.service.*.update* (..))"/>   <Sec:protect-pointcutAccess= "Role_admin"expression= "Execution (* com.test.service.*.remove* (..))"/> </sec:global-method-security>

(2) invokes the specified service method in the Controller method.

@Controller @requestmapping ("Home") Public classHomeController {PrivateUserService UserService; PublicUserService Getuserservice () {returnUserService;} @Resource Public voidSetuserservice (UserService userservice) { This. UserService =UserService;} @RequestMapping ("/") PublicModelandview Index () {Modelandview mv=NewModelandview (); Mv.addobject ("Message", "hello,welcome!"); Mv.setviewname ("Home/index"); UserBean User= This. Userservice.getuserbyname ("Zhangsan"); This. Userservice.adduser (); This. Userservice.removeuser (); This. Userservice.updateuser ();returnMV;}} 

(3) run the test.

style= font-family with role_adminzhangsan When users log on, they can access successfully /home/ page, that is, a successful call to getuserbyname () , adduser () , removeuser () updateuser () method.

when using a Role_user the wangwu user of the role is logged on, an Access denied 403 error occurs when the /home/ page is accessed . Because the role_user role can only access the getuserbyname () Query method, but not access to the following three additions and deletions of the method.

Spring Security Application Development (19) method-based authorization (iii) AOP