spring-projects / spring-projects/spring-security
Document how to replace deprecated MethodSecurityInterceptor when using AclEntryAfterInvocationCollectionFilteringProvider
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
When using ACL, we were able to filter out parts of the returned object in a method invocation based on permissions.
Now on spring-security 5.8.x there's a bunch of deprecated APIs.
I have a MethodSecurityInterceptor which was delegating to AclEntryAfterInvocationCollectionFilteringProvider the decision to filter out parts of the response:
AfterInvocationProviderManager afterInvocationProviderManager = new AfterInvocationProviderManager();
afterInvocationProviderManager.setProviders(List.of(new MyAclEntryAfterInvocationCollectionFilteringProvider()));
MethodSecurityInterceptor interceptor = new MethodSecurityInterceptor();
interceptor.setAuthenticationManager(authenticationManager);
interceptor.setAccessDecisionManager(accessDecisionManager);
interceptor.setAfterInvocationManager(afterInvocationManager);
interceptor.setSecurityMetadataSource(new MapBasedMethodSecurityMetadataSource(Map.of("com.packagea.MyClass.readAll*", new SecurityConfig("AFTER_ACL_COLLECTION_READ")));
In the javadoc and documentation it says to use AuthorizationManagerBeforeMethodInterceptor or AuthorizationManagerAfterMethodInterceptor, but these classes won't allow me to change the returned object, filtering my returned collection.
What would be the supported way in spring-security 5.8.x or 6.x to filter returned objects based on permissions like AclEntryAfterInvocationCollectionFilteringProvider
?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.