Click here to Skip to main content
15,886,258 members
Home / Discussions / Java
   

Java

 
QuestionNoobie in need of help / direction Pin
Member 1163661723-Apr-15 5:09
Member 1163661723-Apr-15 5:09 
QuestionRe: Noobie in need of help / direction Pin
Richard MacCutchan23-Apr-15 5:42
mveRichard MacCutchan23-Apr-15 5:42 
AnswerRe: Noobie in need of help / direction Pin
Member 1163661724-Apr-15 10:03
Member 1163661724-Apr-15 10:03 
GeneralRe: Noobie in need of help / direction Pin
Richard MacCutchan24-Apr-15 22:03
mveRichard MacCutchan24-Apr-15 22:03 
AnswerRe: Noobie in need of help / direction Pin
jschell26-Apr-15 7:23
jschell26-Apr-15 7:23 
QuestionDigital clock javafx Pin
Member 1158717420-Apr-15 19:50
Member 1158717420-Apr-15 19:50 
AnswerRe: Digital clock javafx Pin
Richard MacCutchan20-Apr-15 21:38
mveRichard MacCutchan20-Apr-15 21:38 
QuestionHow Can I Map An Access Path In Spring Security For A Single .Html Page Inside A Folder, Without Giving Access To All The Pages In Htat Folder Pin
CodeZero216-Apr-15 4:09
CodeZero216-Apr-15 4:09 
I'm working in a web application using spring mvc 4 (version: 4.0.9.RELEASE) and spring security 3 (version: 3.2.5.RELEASE), my problem is that i can't restrict access to specific view (.html page) inside a folder.

I have three (3) modules in my web application: Roles, Permissions, Users. Each module have CRUD operations (insert, create, read, delete). I have created twelve (12) permissions in forms of roles in my spring secuirty configuration, each permission would be in charge of a CRUD operation, i would have a permission to create users another one to delete roles and so on until i have 12 permissions.

I said that i created those permissions as roles is because in my web application i have a create role requeriment and in this requeriment i can create a new role and this new role can have permissions mixed from modules, i mean i can create a role that have a create user permission and also delete a role permission.

Beacuse of this i can´t have harcoded the access to the modules using roles in my spring security configuration , but since is not a requeriment to create new permissions i used the permissions to be hardcoded instead of the roles in my spring security configuration.

Even if i use this Spring EL expressions "hasRole", in my bussines logic the string i pass to that expression is a name of a permission that i have stored in my data base.

I have 3 folders: Roles, Permissions, Users; and each folder contains a page for each crud operation like this:
---Roles
  --addRole.html
  --deleteRole.html
  --readRole.html
  --insertRole.html

---Users (same level as Role)
  --.... the same as role but with users

---Permissions (same level as Role)
  --...the same as role but with permission

My problem is that i want to create my spring secuirty configuration to restrict access per page and not per folder, i would like to need to have a specific permission to access a page like this
SQL
.antMatchers("/addRole/").access("hasRole('PERM_ADD_ROLE')")
.antMatchers("/deleteRole/").access("hasRole('PERM_DELETE_ROLE')")
.antMatchers("/readRole/").access("hasRole('PERM_READ_ROLE')")
.antMatchers("/insertRole/").access("hasRole('PERM_INSERT_ROLE')"
.antMatchers("/addUser/").access("hasRole('PERM_ADD_USER')")
.antMatchers("/deleteUser/").access("hasRole('PERM_DELETE_USER')")

But when i do this if i log-in with a user that have PERM_ADD_ROLE this user have access to all the ROLE pages ( deleteRole, readRole an insertROle) and this shouldn't happen, the user should have only access to the addRole page since his permission is "PERM_ADD_ROLE", but since the other pages i mention are in the same folder Roles i believe thats why he access them but this shouldn't happen.

My project in spring mvc is configured using java config and no XMLs, i have my application configured with classes and not XML

Here is my spring security class configuration.
@Configuration
@EnableWebMvcSecurity
public class SecurityConfign extends WebSecurityConfigurerAdapter {

    @Autowired
    private AutProvider aut;

   @Override
    protected void configure( HttpSecurity http ) throws Exception 
    {
        http
            .authenticationProvider(aut)
            .authorizeRequests()
                .antMatchers("/resources/").permitAll()
                .antMatchers("/css/").permitAll() 
                .antMatchers("/js/").permitAll()
                .antMatchers("/img/").permitAll() 
                .antMatchers("/sound/").permitAll() 
                .antMatchers("/fonts/").permitAll()
                .antMatchers("/ajax/").permitAll()
                .antMatchers("/php/").permitAll()
                .antMatchers("/xml/").permitAll()
               .antMatchers("/addRole/").access("hasRole('PERM_ADD_ROLE')")
         .antMatchers("/deleteRole/").access("hasRole('PERM_DELETE_ROLE')")
             .antMatchers("/readRole/").access("hasRole('PERM_READ_ROLE')")
          .antMatchers("/insertRole/").access("hasRole('PERM_INSERT_ROLE')"<br />
               .antMatchers("/addUser/").access("hasRole('PERM_ADD_USER')")
         .antMatchers("/deleteUser/**").access("hasRole('PERM_DELETE_USER')")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                    .loginPage("/login/login")
                    .permitAll()
                    .and()
                .logout()<br />
                    .permitAll()
                .and()
                    .csrf().disable();

    }
}

And here is my AuthenticationProvider class
@Component
public class AutProvider implements AuthenticationProvider {

@Override
public Authentication authenticate(Authentication authentication)
        throws AuthenticationException {

    String name = null;
    String password = null;
    Authentication auth = null;

    try {
        name = authentication.getName();
        password = authentication.getCredentials().toString();

        if (name.equals("admin@admin.com") && password.equals("password")) {
            List<GrantedAuthority> grantedAuths = new ArrayList<>();
            grantedAuths.add(new SimpleGrantedAuthority("PERM_ADD_ROLE"));
            grantedAuths.add(new SimpleGrantedAuthority("PERM_ADD_USER"));
            //i know that this part is hardcoded but i would have a method here to bring those permissions from the data base
            auth = new UsernamePasswordAuthenticationToken(name, password, grantedAuths);
        }
    } catch (AuthenticationException e) {
        e.printStackTrace();
        throw e;
    }

    return auth;
}

@Override
public boolean supports(Class<?> authentication) {
    return authentication.equals(UsernamePasswordAuthenticationToken.class);
}

}

and here is some of my controllers as and example the Role COntroller
@Controller
@RequestMapping("/roles/")
public class RoleController {

    @RequestMapping(value = "readRole", method = RequestMethod.GET)
    public String readArole(Model model) {

        return "/roles/readRole";
    }
}

In resume if i give a specifc permission to a user like PERM_ADD_ROLE with this permission the user have access to all the pages in the Roles folder and this shouldn't happen.
AnswerRe: How Can I Map An Access Path In Spring Security For A Single .Html Page Inside A Folder, Without Giving Access To All The Pages In Htat Folder Pin
PIEBALDconsult16-Apr-15 4:27
mvePIEBALDconsult16-Apr-15 4:27 
QuestionFile Handling Pin
Member 115824517-Apr-15 6:17
Member 115824517-Apr-15 6:17 
QuestionRe: File Handling Pin
Richard MacCutchan7-Apr-15 21:09
mveRichard MacCutchan7-Apr-15 21:09 
AnswerRe: File Handling Pin
Member 115824519-Apr-15 8:34
Member 115824519-Apr-15 8:34 
AnswerRe: File Handling Pin
Richard Andrew x649-Apr-15 8:47
professionalRichard Andrew x649-Apr-15 8:47 
GeneralRe: File Handling Pin
Richard MacCutchan9-Apr-15 21:50
mveRichard MacCutchan9-Apr-15 21:50 
GeneralRe: File Handling Pin
Member 1158245111-Apr-15 5:04
Member 1158245111-Apr-15 5:04 
AnswerRe: File Handling Pin
jschell9-Apr-15 12:05
jschell9-Apr-15 12:05 
GeneralRe: File Handling Pin
Member 1158245111-Apr-15 5:02
Member 1158245111-Apr-15 5:02 
Questionhow do i Make a function directory count Pin
Member 115830955-Apr-15 19:36
Member 115830955-Apr-15 19:36 
Answer[REPOST] Re: how do i Make a function directory count Pin
Sascha Lefèvre5-Apr-15 20:15
professionalSascha Lefèvre5-Apr-15 20:15 
Questioncode for extracting result to applet Pin
hari@251-Apr-15 20:38
hari@251-Apr-15 20:38 
AnswerRe: code for extracting result to applet Pin
Richard MacCutchan1-Apr-15 21:16
mveRichard MacCutchan1-Apr-15 21:16 
Questionregarding applets Pin
hari@251-Apr-15 20:36
hari@251-Apr-15 20:36 
AnswerRe: regarding applets Pin
Richard MacCutchan1-Apr-15 21:16
mveRichard MacCutchan1-Apr-15 21:16 
Questionjava tables Pin
Member 1068310231-Mar-15 12:57
Member 1068310231-Mar-15 12:57 
AnswerRe: java tables Pin
Sascha Lefèvre31-Mar-15 17:08
professionalSascha Lefèvre31-Mar-15 17:08 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.