Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-12 21:33:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1473: Remove references to ContactSecurityVoter.

Browse Source 
Replaced with reference to Oleg's blog article as an example of custom voter use
This commit is contained in:
Luke Taylor 2010-05-03 13:24:55 +01:00
parent fcf33afce0
commit 2c44461264
1 changed files with 13 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
docs/manual/src/docbook/authorization-common.xml
View File

@ -65,7 +65,7 @@
methods: methods:
<programlisting> <programlisting>
void decide(Authentication authentication, Object secureObject, void decide(Authentication authentication, Object secureObject,
List&lt;ConfigAttribute&gt; config) throws AccessDeniedException; Collection&lt;ConfigAttribute&gt; attrs) throws AccessDeniedException;
boolean supports(ConfigAttribute attribute); boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz); boolean supports(Class clazz);
</programlisting> </programlisting>
@ -113,7 +113,7 @@
<para>The <interfacename>AccessDecisionVoter</interfacename> interface has three <para>The <interfacename>AccessDecisionVoter</interfacename> interface has three
methods: methods:
<programlisting> <programlisting>
int vote(Authentication authentication, Object object, List&lt;ConfigAttribute&gt; config); int vote(Authentication authentication, Object object, Collection&lt;ConfigAttribute&gt; attrs);
boolean supports(ConfigAttribute attribute); boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz); boolean supports(Class clazz);
</programlisting> </programlisting>
@ -173,24 +173,18 @@ boolean supports(Class clazz);
<classname>AuthenticatedVoter</classname>. See the Javadoc for this class for <classname>AuthenticatedVoter</classname>. See the Javadoc for this class for
more information. </para> more information. </para>
</section> </section>
<section> <section xml:id="authz-custom-voter">
<title>Custom Voters</title> <title>Custom Voters</title>
<para>It is also possible to implement a custom <para>Obviously, you can also implement a custom
<interfacename>AccessDecisionVoter</interfacename>. Several examples are <interfacename>AccessDecisionVoter</interfacename> and you can
provided in Spring Security unit tests, including put just about any access-control logic you want in it. It might
<literal>ContactSecurityVoter</literal> and <literal>DenyVoter</literal>. The be specific to your application (business-logic related) or it
<literal>ContactSecurityVoter</literal> abstains from voting decisions where a might implement some security administration logic. For example, you'll find
<literal>CONTACT_OWNED_BY_CURRENT_USER</literal> a <link xlink:href='http://blog.springsource.com/2009/01/02/spring-security-customization-part-2-adjusting-secured-session-in-real-time/'>
<literal>ConfigAttribute</literal> is not found. If voting, it queries the blog article</link> on the SpringSource web site which describes how to
<classname>MethodInvocation</classname> to extract the owner of the use a voter to deny access in real-time to users whose accounts have
<literal>Contact</literal> object that is subject of the method call. It votes been suspended.
to grant access if the <literal>Contact</literal> owner matches the principal </para>
presented in the <interfacename>Authentication</interfacename> object. It could
have just as easily compared the <literal>Contact</literal> owner with some
<interfacename>GrantedAuthority</interfacename> the
<interfacename>Authentication</interfacename> object presented. All of this is
achieved with relatively few lines of code and demonstrates the flexibility of
the authorization model.</para>
</section> </section>
</section> </section>
</section> </section>