spring-projects / spring-projects/spring-security
SEC-2080: Add principal name based checks to SecurityExpressionRoot
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Michael Osipov (Migrated from SEC-2080) said:
For now, Spring Sec supports role-based or pass-all-or-nothing access checks.
Checks like is(String username), isAny(String... username), isPrincipal, isAnyPrincipal would cover other useful cases.
In may env there are only roles for the prod system but not the test system or an authz system where the developer has no write access to, like Active Directory. Quick setups like access="is('michael-o@jira')" would ease this issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SecurityExpressionRoot, the entry point named in the issue, and read its existing role-based and pass-through access checks. Trace how expression methods are exposed and determine the expected behavior for is, isAny, isPrincipal, and isAnyPrincipal; done means these principal-name checks are available for security expressions and behave consistently with the existing checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100