spring security:intercept-url pattern access="#id == 1

Question

i have project were iam spring security 3.1.3 and mvc 3.2

i want too allow a url wehen in the userid in the path is matching the principal userid

    <security:intercept-url pattern="/user/{id}/edit" access="#id == principal.userId"/>

http use-expressions it set to true and when a try principal.userId == 1 it works but i need to use the extracted value from the url.

i already tried all possible combinations.

Answer 1

It's not possible. But there is another way. You can define you own web expression that will be responsible for extracting of id parameter from URL. It may looks like that:

<security:intercept-url pattern="/user/{id}/edit" access="getIdUrlPathParameter() == principal.userId"/>

To do so you need:
1. Add CustomWebSecurityExpressionRoot that extends WebSecurityExpressionRoot
2. Add getIdUrlPathParameter() method. It will have access to HttpServletRequest object.
3. Define CustomWebSecurityExpressionHandler that extends DefaultWebSecurityExpressionHandler. Override createSecurityExpressionRoot method abd use your CustomWebSecurityExpressionRoot here.
4. Define custom access decision manager (xml below)
5. Inject it into your http element via access-decision-manager-ref attribute

<security:http access-decision-manager-ref="customAccessDecisionManagerBean" >
    <security:intercept-url pattern="/user/{id}/edit" access="getIdUrlPathParameter() == principal.userId"/>
</security:http>
<bean id="customWebSecurityExpressionHandler" class="com.domain.security.CustomWebSecurityExpressionHandler"/>
<bean id="customAccessDecisionManagerBean" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                <property name="expressionHandler" ref="customWebSecurityExpressionHandler" />
            </bean>
        </list>
    </property>
</bean>