liveBook · Manning

AuthorizationManager

As explained in Spring Security in Action, Second Edition

AuthorizationManager is a Spring Security contract for evaluating whether an authenticated principal is authorized for an object or request.

AuthorizationManager is a Spring Security contract for deciding whether an authenticated principal may access an object or request. The access() method uses it to support custom authorization rules, including Spring Security’s WebExpressionAuthorizationManager for SpEL expressions. section 7.1.1

Use the simplest authorization mechanism that expresses the endpoint policy:

  • Use hasAuthority() when one configured authority is required. section 7.1.1
  • Use hasAnyAuthority() when any one of several authorities is sufficient. section 7.1.1
  • Use access() with an AuthorizationManager or expression when simpler methods cannot represent the rule; complex expressions can reduce readability. section 7.1.1

Authority-based endpoint authorization

A SecurityFilterChain can require WRITE authority for every request with c.anyRequest().hasAuthority("WRITE"). Jane, assigned WRITE, receives Hello!, while John, assigned READ, receives HTTP 403 Forbidden.

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines the contract and contrasts built-in authority checks with custom or SpEL-based access rules, while stopping short of implementation internals.
Examples
Demonstrates READ and WRITE users, hasAuthority(), hasAnyAuthority(), access(), curl requests, successful responses, and HTTP 403 failures.
What you can do after
Apply it via access() to implement custom or expression-based endpoint authorization when authority shortcuts are insufficient.
How it connects
Connects endpoint authorization with user authorities, SecurityFilterChain, access(), and Spring Expression Language.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.