root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 18 Packages Projects Releases Wiki Activity

Update document 

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
This commit is contained in:
Tran Ngoc Nhan 2025-06-21 01:41:15 +07:00
parent ee4d971db8
commit d1c4351eb8
7 changed files with 36 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/modules/ROOT/pages/reactive/authorization/method.adoc
View File

@ -308,7 +308,7 @@ Java::
@Component @Component
public class MyPreAuthorizeAuthorizationManager implements ReactiveAuthorizationManager<MethodInvocation> { public class MyPreAuthorizeAuthorizationManager implements ReactiveAuthorizationManager<MethodInvocation> {
@Override @Override
public Mono<AuthorizationDecision> check(Supplier<Authentication> authentication, MethodInvocation invocation) { public Mono<AuthorizationResult> authorize(Supplier<Authentication> authentication, MethodInvocation invocation) {
// ... authorization logic // ... authorization logic
} }
@ -321,7 +321,7 @@ Kotlin::
---- ----
@Component @Component
class MyPreAuthorizeAuthorizationManager : ReactiveAuthorizationManager<MethodInvocation> { class MyPreAuthorizeAuthorizationManager : ReactiveAuthorizationManager<MethodInvocation> {
override fun check(authentication: Supplier<Authentication>, invocation: MethodInvocation): Mono<AuthorizationDecision> { override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocation): Mono<AuthorizationResult> {
// ... authorization logic // ... authorization logic
} }

8
docs/modules/ROOT/pages/servlet/appendix/faq.adoc
View File

@ -544,7 +544,7 @@ public class DynamicAuthorizationManager implements AuthorizationManager<Request
// ... // ...
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, RequestAuthorizationContext context) { public AuthorizationResult authorize(Supplier<Authentication> authentication, RequestAuthorizationContext context) {
// query the external service // query the external service
} }
} }
@ -565,7 +565,7 @@ class DynamicAuthorizationManager : AuthorizationManager<RequestAuthorizationCon
// ... // ...
override fun check(authentication: Supplier<Authentication?>?, context: RequestAuthorizationContext?): AuthorizationDecision { override fun authorize(authentication: Supplier<Authentication?>?, context: RequestAuthorizationContext?): AuthorizationResult {
// look up rules from the database // look up rules from the database
} }
} }
@ -595,7 +595,7 @@ public class DynamicAuthorizationManager implements AuthorizationManager<MethodI
// ... // ...
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, MethodInvocation invocation) { public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocation invocation) {
// query the external service // query the external service
} }
} }
@ -617,7 +617,7 @@ class DynamicAuthorizationManager : AuthorizationManager<MethodInvocation?> {
private val authz: MyExternalAuthorizationService? = null private val authz: MyExternalAuthorizationService? = null
// ... // ...
override fun check(authentication: Supplier<Authentication?>?, invocation: MethodInvocation?): AuthorizationDecision { override fun authorize(authentication: Supplier<Authentication?>?, invocation: MethodInvocation?): AuthorizationResult {
// query the external service // query the external service
} }
} }

8
docs/modules/ROOT/pages/servlet/authorization/architecture.adoc
View File

@ -99,7 +99,7 @@ The `AuthorizationManager` interface contains two methods:
[source,java] [source,java]
---- ----
AuthorizationDecision check(Supplier<Authentication> authentication, Object secureObject); AuthorizationResult authorize(Supplier<Authentication> authentication, Object secureObject);
default void verify(Supplier<Authentication> authentication, Object secureObject) default void verify(Supplier<Authentication> authentication, Object secureObject)
throws AccessDeniedException { throws AccessDeniedException {
@ -113,7 +113,7 @@ For example, let's assume the secure object was a `MethodInvocation`.
It would be easy to query the `MethodInvocation` for any `Customer` argument, and then implement some sort of security logic in the `AuthorizationManager` to ensure the principal is permitted to operate on that customer. It would be easy to query the `MethodInvocation` for any `Customer` argument, and then implement some sort of security logic in the `AuthorizationManager` to ensure the principal is permitted to operate on that customer.
Implementations are expected to return a positive `AuthorizationDecision` if access is granted, negative `AuthorizationDecision` if access is denied, and a null `AuthorizationDecision` when abstaining from making a decision. Implementations are expected to return a positive `AuthorizationDecision` if access is granted, negative `AuthorizationDecision` if access is denied, and a null `AuthorizationDecision` when abstaining from making a decision.
`verify` calls `check` and subsequently throws an `AccessDeniedException` in the case of a negative `AuthorizationDecision`. `verify` calls `authorize` and subsequently throws an `AccessDeniedException` in the case of a negative `AuthorizationDecision`.
[[authz-delegate-authorization-manager]] [[authz-delegate-authorization-manager]]
=== Delegate-based AuthorizationManager Implementations === Delegate-based AuthorizationManager Implementations
@ -180,7 +180,7 @@ public class AccessDecisionManagerAuthorizationManagerAdapter implements Authori
private final SecurityMetadataSource securityMetadataSource; private final SecurityMetadataSource securityMetadataSource;
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, Object object) { public AuthorizationResult authorize(Supplier<Authentication> authentication, Object object) {
try { try {
Collection<ConfigAttribute> attributes = this.securityMetadataSource.getAttributes(object); Collection<ConfigAttribute> attributes = this.securityMetadataSource.getAttributes(object);
this.accessDecisionManager.decide(authentication.get(), object, attributes); this.accessDecisionManager.decide(authentication.get(), object, attributes);
@ -216,7 +216,7 @@ public class AccessDecisionVoterAuthorizationManagerAdapter implements Authoriza
private final SecurityMetadataSource securityMetadataSource; private final SecurityMetadataSource securityMetadataSource;
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, Object object) { public AuthorizationResult authorize(Supplier<Authentication> authentication, Object object) {
Collection<ConfigAttribute> attributes = this.securityMetadataSource.getAttributes(object); Collection<ConfigAttribute> attributes = this.securityMetadataSource.getAttributes(object);
int decision = this.accessDecisionVoter.vote(authentication.get(), object, attributes); int decision = this.accessDecisionVoter.vote(authentication.get(), object, attributes);
switch (decision) { switch (decision) {

2
docs/modules/ROOT/pages/servlet/authorization/authorize-http-requests.adoc
View File

@ -861,7 +861,7 @@ Java::
@Component @Component
public final class OpenPolicyAgentAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> { public final class OpenPolicyAgentAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> {
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, RequestAuthorizationContext context) { public AuthorizationResult authorize(Supplier<Authentication> authentication, RequestAuthorizationContext context) {
// make request to Open Policy Agent // make request to Open Policy Agent
} }
} }

41
docs/modules/ROOT/pages/servlet/authorization/events.adoc
View File

@ -95,29 +95,28 @@ public class MyAuthorizationEventPublisher implements AuthorizationEventPublishe
@Override @Override
public <T> void publishAuthorizationEvent(Supplier<Authentication> authentication, public <T> void publishAuthorizationEvent(Supplier<Authentication> authentication,
T object, AuthorizationDecision decision) { T object, AuthorizationResult result) {
if (decision == null) { if (result == null) {
return; return;
} }
if (!decision.isGranted()) { if (!result.isGranted()) {
this.delegate.publishAuthorizationEvent(authentication, object, decision); this.delegate.publishAuthorizationEvent(authentication, object, result);
return; return;
} }
if (shouldThisEventBePublished(decision)) { if (shouldThisEventBePublished(result)) {
AuthorizationGrantedEvent granted = new AuthorizationGrantedEvent( AuthorizationGrantedEvent granted = new AuthorizationGrantedEvent(
authentication, object, decision); authentication, object, result);
this.publisher.publishEvent(granted); this.publisher.publishEvent(granted);
} }
} }
private boolean shouldThisEventBePublished(AuthorizationDecision decision) { private boolean shouldThisEventBePublished(AuthorizationResult result) {
if (!(decision instanceof AuthorityAuthorizationDecision)) { if (result instanceof AuthorityAuthorizationDecision authorityAuthorizationDecision) {
return false; Collection<GrantedAuthority> authorities = authorityAuthorizationDecision.getAuthorities();
} for (GrantedAuthority authority : authorities) {
Collection<GrantedAuthority> authorities = ((AuthorityAuthorizationDecision) decision).getAuthorities(); if ("ROLE_ADMIN".equals(authority.getAuthority())) {
for (GrantedAuthority authority : authorities) { return true;
if ("ROLE_ADMIN".equals(authority.getAuthority())) { }
return true;
} }
} }
return false; return false;
@ -137,22 +136,22 @@ class MyAuthorizationEventPublisher(val publisher: ApplicationEventPublisher,
override fun <T : Any?> publishAuthorizationEvent( override fun <T : Any?> publishAuthorizationEvent(
authentication: Supplier<Authentication>?, authentication: Supplier<Authentication>?,
`object`: T, `object`: T,
decision: AuthorizationDecision? result: AuthorizationResult?
) { ) {
if (decision == null) { if (result == null) {
return return
} }
if (!decision.isGranted) { if (!result.isGranted) {
this.delegate.publishAuthorizationEvent(authentication, `object`, decision) this.delegate.publishAuthorizationEvent(authentication, `object`, result)
return return
} }
if (shouldThisEventBePublished(decision)) { if (shouldThisEventBePublished(result)) {
val granted = AuthorizationGrantedEvent(authentication, `object`, decision) val granted = AuthorizationGrantedEvent(authentication, `object`, result)
this.publisher.publishEvent(granted) this.publisher.publishEvent(granted)
} }
} }
private fun shouldThisEventBePublished(decision: AuthorizationDecision): Boolean { private fun shouldThisEventBePublished(result: AuthorizationResult): Boolean {
if (decision !is AuthorityAuthorizationDecision) { if (decision !is AuthorityAuthorizationDecision) {
return false return false
} }

8
docs/modules/ROOT/pages/servlet/authorization/method-security.adoc
View File

@ -1371,12 +1371,12 @@ Java::
@Component @Component
public class MyAuthorizationManager implements AuthorizationManager<MethodInvocation>, AuthorizationManager<MethodInvocationResult> { public class MyAuthorizationManager implements AuthorizationManager<MethodInvocation>, AuthorizationManager<MethodInvocationResult> {
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, MethodInvocation invocation) { public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocation invocation) {
// ... authorization logic // ... authorization logic
} }
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, MethodInvocationResult invocation) { public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocationResult invocation) {
// ... authorization logic // ... authorization logic
} }
} }
@ -1388,11 +1388,11 @@ Kotlin::
---- ----
@Component @Component
class MyAuthorizationManager : AuthorizationManager<MethodInvocation>, AuthorizationManager<MethodInvocationResult> { class MyAuthorizationManager : AuthorizationManager<MethodInvocation>, AuthorizationManager<MethodInvocationResult> {
override fun check(authentication: Supplier<Authentication>, invocation: MethodInvocation): AuthorizationDecision { override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocation): AuthorizationResult {
// ... authorization logic // ... authorization logic
} }
override fun check(authentication: Supplier<Authentication>, invocation: MethodInvocationResult): AuthorizationDecision { override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocationResult): AuthorizationResult {
// ... authorization logic // ... authorization logic
} }
} }

2
docs/modules/ROOT/pages/servlet/integrations/websocket.adoc
View File

@ -227,7 +227,7 @@ public final class MessageExpressionAuthorizationManager implements Authorizatio
} }
@Override @Override
public AuthorizationDecision check(Supplier<Authentication> authentication, MessageAuthorizationContext<?> context) { public AuthorizationResult authorize(Supplier<Authentication> authentication, MessageAuthorizationContext<?> context) {
EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication, context.getMessage()); EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication, context.getMessage());
boolean granted = ExpressionUtils.evaluateAsBoolean(this.expression, ctx); boolean granted = ExpressionUtils.evaluateAsBoolean(this.expression, ctx);
return new ExpressionAuthorizationDecision(granted, this.expression); return new ExpressionAuthorizationDecision(granted, this.expression);