Skip to content

PrePostMethodSecurityConfiguration is missing a setter for custom PermissionEvaluator #19084

@Siggen

Description

@Siggen

Describe the bug
PrePostMethodSecurityConfiguration takes in account custom GrantedAuthorityDefaults, RoleHierarchy and AuthorizationManagerFactory beans but ignores custom PermissionEvaluator bean.

To Reproduce
Setup a context with a custom permission evaluator, for instance PrePostMethodSecurityConfigurationTests with:

@Configuration
@EnableMethodSecurity
static class CustomPermissionEvaluatorConfig {

	@Bean
	PermissionEvaluator permissionEvaluator() {
		return new PermissionEvaluator() {
			@Override
			public boolean hasPermission(Authentication authentication, Object targetDomainObject,
					Object permission) {
				return "grant".equals(targetDomainObject);
			}

			@Override
			public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType,
					Object permission) {
				throw new UnsupportedOperationException();
			}
		};
	}

}

=> custom PermissionEvaluator bean is not injected into PrePostMethodSecurityConfiguration's default expression handler and following test fails:

@WithMockUser
@Test
public void postHasPermissionWhenParameterIsGrantThenPasses() {
	this.spring.register(CustomPermissionEvaluatorConfig.class, MethodSecurityServiceConfig.class).autowire();
	String result = this.methodSecurityService.postHasPermission("grant");
	assertThat(result).isNull();
}

Expected behavior
Custom permission evaluator should be injected in PrePostMethodSecurityConfiguration's default expression handler.

Sample
I will link to a PR soon.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions