spring-projects / spring-projects/spring-security
Allow MethodSecurityInterceptor.publishAuthorizationSuccess to be configured
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Be able to configure MethodSecurityInterceptor to publish AuthorizedEvent.
I've noticed that here it is suggested to use ObjectPostProcessor to configure FilterSecurityInterceptor in the same way.
I propose to use the same ObjectPostProcessor approach for MethodSecurityInterceptor at the point of bean creation here.
Current Behavior
The only way to configure MethodSecurityInterceptor that I found so far is through BeanPostProcessor which, I believe, isn't intended.
Context
I'm trying to build an authorization audit log to keep track of users and roles they actually use vs what is defined on a company level to optimise the setup over time.
I've noticed that there is no way to configure MethodSecurityInterceptor and thought that there's a simple fix so worth contributing.
If there's an another solution I haven't thought of - please suggest :)
I've also asked on StackOverflow to no avail.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java at the bean-creation point around line 150. Compare the existing ObjectPostProcessor approach for FilterSecurityInterceptor and trace how MethodSecurityInterceptor is configured. Done means MethodSecurityInterceptor can be configured to publish AuthorizedEvent without relying on BeanPostProcessor.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100