我有一个应用程序,用户可以在其中输入自定义角色名称和权限。
例如,用户可以创建名为“Human Resources
”的角色,该角色具有以下属性:
showDashboard = true;
showSuppliers = false;
showEmployees = true;
我想限制getSuppliers
基于showSuppliers
的服务属性。
@PreAuthorize("WHEN showSuppliers IS TRUE")
public Page<Supplier> getSuppliers();
角色实体:
@Entity
public class Role {
@Id
@GeneratedValue(strategy = GenerationType.AUTO, generator = "native")
@GenericGenerator(name = "native", strategy = "native")
private Long id;
private String name;
private boolean showDashboard;
private boolean showSuppliers;
private boolean showEmployees;
}
最佳答案
您可以在 PreAuthorize
表达式中引用 bean。首先这个 bean/组件:
@Component("authorityChecker")
public class AuthorityChecker {
public boolean canShowSuppliers(Authentication authentication) {
for (Authority authority : authentication.getAuthorites()) {
Role role = (Role)authority; // may want to check type before to avoid ClassCastException
if (role.isShowSuppliers()) {
return true;
}
}
return false;
}
}
对此的注释将是:
@PreAuthorize("@authorityChecker.canShowSuppliers(authentication)")
public Page<Supplier> getSuppliers();
它将把当前用户的 Authentication 对象传递给上面的 bean/组件。
关于java - Spring Security @PreAuthorize 基于自定义 boolean 属性值,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/53248269/