Fine-Grained Access Control

In this chapter, we will first examine two ways to implement fine-grained authorization—authorization that may affect portions of a page of the application. Next, we will look at Spring Security's approach to securing the business tier through method annotation and the use of interface-based proxies to accomplish AOP. Then, we will review an interesting capability of annotation-based security that allows for role-based filtering on collections of data. Last, we will look at how class-based proxies differ from interface-based proxies.

During the course of this chapter, we'll cover the following topics:

• Configuring and experimenting with different methods of performing in-page authorization checks on content, given the security context of a user request
• Performing configuration and code annotation to make caller preauthorization a key...

Gradle dependencies

There are a number of optional dependencies that may be required, depending on what features you decide to use. Many of these dependencies are commented as Spring Boot includes them already in the starter parent. You will find that our build.gradle file already includes all of the following dependencies:

    //build.gradle
    // Required for JSR-250 based security:
    // JSR-250 Annotations

    compile ('javax.annotation:javax.annotation-api:1.3')

    // Already provided by Spring Boot
    // compile('cglib:cglib-nodep')
    // Already provided by Spring Boot
    // Required for protect-pointcut
    // compile('org.aspectj:aspectjweaver')

Integrating Spring Expression Language (SpEL)

...

Conditional rendering with the Thymeleaf Spring Security tag library

The most common functionality used in the Thymeleaf Spring Security tag library is to conditionally render portions of the page based on authorization rules. This is done with the < sec:authorize*> tag that functions similarly to the <if> tag in the core JSTL library, in that the tag's body will render depending on the conditions provided in the tag attributes. We have already seen a very brief demonstration of how the Spring Security tag library can be used to restrict the viewing of content if the user is not logged in.

Conditional rendering based on URL access rules

The Spring Security tag library provides functionality to render content...

Interface-based proxies

In the given example from the previous section, Spring Security used an interface-based proxy to secure our getEvents method. Let's take a look at the simplified pseudocode of what happened to understand how this works:

    DefaultCalendarService originalService = context.getBean
    (CalendarService.class)
    CalendarService secureService = new CalendarService() {
     … other methods just delegate to originalService ...
      public List<Event> getEvents() {
        if(!permitted(originalService.getEvents)) {
           throw AccessDeniedException()
          }
       return originalCalendarService.getEvents()
      }
   };

You can see that Spring creates the original CalendarService just as it normally does. However, it instructs our code to use another implementation of CalendarService that performs a security check before returning the result...

JSR-250 compliant standardized rules

JSR-250 Common Annotations for the Java platform defines a series of annotations, some that are security-related, which are intended to be portable across JSR-250 compliant runtime environments. The Spring Framework became compliant with JSR-250 as part of the Spring 2.x release, including the Spring Security framework.

While JSR-250 annotations are not as expressive as Spring native annotations, they have the benefit that the declarations they provide are compatible across implementing Java EE application servers such as Glassfish or service-oriented runtime frameworks such as Apache Tuscany. Depending on your application's needs and requirements for portability, you may decide that the trade-off of reduced specificity is worth the portability of the code.

To implement the rule we specified in the first example, we make a few changes...

Summary

In this chapter, we have covered most of the remaining areas in standard Spring Security implementations that deal with authorization. We've learned enough to take a thorough pass through the JBCP calendar application and verify that proper authorization checks are in place in all tiers of the application, to ensure that malicious users cannot manipulate or access data to which they do not have access.

We developed two techniques for micro-authorization, namely filtering out in-page content based on authorization or other security criteria using the Thymeleaf Spring Security tag library and Spring MVC controller data binding. We also explored several methods of securing business functions and data in the business tier of our application and supporting a rich, declarative security model that was tightly integrated with the code. We also learned how to secure our Spring...