1

I have a use case where I need to secure the endpoints of my application through ABAC Authorization. The code to perform ABAC Authorization is already present. I found several examples on How to create custom Authentication filter in Spring Security. One of them is here. Is there a similar standardized way to implement a custom AuthorizationFilter in Spring Security ?

Is there an object similar to Authentication that needs to be set in Spring's Security context?

cdan
  • 3,470
  • 13
  • 27
Anuja Barve
  • 300
  • 1
  • 4
  • 23

1 Answers1

2

In Spring Security 5.5, AuthorizationFilter and AuthorizationManager were introduced.

You can construct an AuthorizationManager, provide it in the DSL:

http
    // ...
    .authorizeHttpRequests((authorize) -> authorize
        .anyRequest().access(myAuthorizationManager())
    )
    // ..

and the DSL will construct an AuthorizationFilter with your custom manager.

If you are on an earlier version of Spring Security, you can instead wire an AccessDecisionManager.

jzheaux
  • 7,042
  • 3
  • 22
  • 36