Consider Making Attribute Based Authorization Simpler to implement

In modern applications authorization decisions for different end points can take a look at many attributes of a request, who's logged in, the url being requested, the location the request is coming from, the type of authentication used to make the request (password, 2 factor, passkey, fido credentials ... etc, the type of device the user is using. Expressing complex authorization rules based on multiple request attributes is currently hard. The spring configuration DSL does not have enough expressiveness to capture complex authorization logic, it is common to see snippets of code such as authorizeRequests.requestMatchers("/myendpoint").permitAll(); This code has two problems.

• The matching is too coarse grained. Only the url is considered when a more complex set of attributes might need to be considered.
• The result is yes / no binary choice permitted or denied. For some end points the decision might be yes, no, or request to re-verify the identity of the user.

Ideally the configuration DSL for spring should have an easy way for developers to express more complex authorization rules based on multiple attribute of a request, and more nuanced authorization decision beyond yes/no.

related to #13266

Start by reviewing the Spring configuration DSL around authorizeRequests.requestMatchers and the related discussion in #13266. Define what an implementable DSL change would need to express for multiple request attributes and for decisions beyond permit or deny; the issue is done only when that design is agreed and specified.