spring-projects / spring-projects/spring-security

Document how to replace deprecated MethodSecurityInterceptor when using AclEntryAfterInvocationCollectionFilteringProvider

Open
#12,620 6 comments 0 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

in: docs type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

When using ACL, we were able to filter out parts of the returned object in a method invocation based on permissions.
Now on spring-security 5.8.x there's a bunch of deprecated APIs.

I have a MethodSecurityInterceptor which was delegating to AclEntryAfterInvocationCollectionFilteringProvider the decision to filter out parts of the response:

        AfterInvocationProviderManager afterInvocationProviderManager = new AfterInvocationProviderManager();
        afterInvocationProviderManager.setProviders(List.of(new MyAclEntryAfterInvocationCollectionFilteringProvider()));

        MethodSecurityInterceptor interceptor = new MethodSecurityInterceptor();
        interceptor.setAuthenticationManager(authenticationManager);
        interceptor.setAccessDecisionManager(accessDecisionManager);
        interceptor.setAfterInvocationManager(afterInvocationManager);
        interceptor.setSecurityMetadataSource(new MapBasedMethodSecurityMetadataSource(Map.of("com.packagea.MyClass.readAll*", new SecurityConfig("AFTER_ACL_COLLECTION_READ")));

In the javadoc and documentation it says to use AuthorizationManagerBeforeMethodInterceptor or AuthorizationManagerAfterMethodInterceptor, but these classes won't allow me to change the returned object, filtering my returned collection.

What would be the supported way in spring-security 5.8.x or 6.x to filter returned objects based on permissions like AclEntryAfterInvocationCollectionFilteringProvider
?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.