spring-projects / spring-projects/spring-security
SEC-2852: Possibility to impersonate a Principal when using annotation hasPermission
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Oliver Fernandez (Migrated from SEC-2852) said:
It would be very useful to be able to impersonate another principal when using the annotation hasPermission
The current interface SecurityExpressionOperations only declares the following method
boolean hasPermission(Object target, Object permission)
I propose to also declare:
boolean hasPermission(UserDetails principal, Object target, Object permission)
A very typical use case is that an administrator wants to list the entities a given user has permissions to read, and then manage those permissions.
In the following gist there is a possible implementation of this method:
https://gist.github.com/oliverfernandez/c56f833d058fcae53a1b
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the SecurityExpressionOperations interface and the existing hasPermission implementation, then compare the proposed overload with the linked gist. Done means annotation-based hasPermission can evaluate permissions for a supplied UserDetails principal, with behavior matching the existing target-and-permission form.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100