Spring Security Authorized Accessdecisionmanager

Spring Security Authorized Accessdecisionmanager Blog Category:

• Security
• Spring

In the previous blog there is a configuration:
XML code

2. <http auto-config="false" disable-url-rewriting="true" use-expressions="true" entry-point-ref="Dtauth"
4. create-session="never">
6. <!--<session-management session-authentication-strategy-ref= "dtsession"/> --
8. <intercept-url pattern="/unread/get" access="isauthenticated ()"/>
10. <intercept-url pattern="/authtest.xhtm" access="Hasrole (' working ')"/>
12. <intercept-url pattern="/authtest1.xhtm" access="hasrole (' trac ')"/>
14. <intercept-url pattern="/cmmt/uc" access="isauthenticated ()"/>
16. <intercept-url pattern="/favicon.ico" access="Denyall"/>
18. <intercept-url pattern="/**" access="Permitall"/>
20. <custom-filter position="Pre_auth_filter" ref="dtsessionmgr"/>
22. </http>

Pattern means that url,access represents the permission for a URL, but where does this isauthenticated () be executed exactly? The original spring provides an authorization mechanism, which is implemented by the Org.springframework.security.access.AccessDecisionManager interface.

This interface defines this method:
Java code

1. Void decide (authentication authentication, Object object, Collection<configattribute> configattributes)
2. throws Accessdeniedexception, insufficientauthenticationexception;

Corresponds to the above configuration: object is Url,configattributes is an access. The common implementation class is affirmativebased

Spring Security Authorized Accessdecisionmanager