What is the structure of spring security?

answered 2011-04-05 11:33:05 +0800

terrytornado
9393 ● 3 ● 7 ● 16
http://www.oxitec.de/

updated 2011-04-05 11:46:21 +0800

Hi Jaider2523,

welcome to zk.

The Zksample2 is a community project. So if you study the history you can see that it grows until zk 3.5.2. In that time only a few guys work with spring security and zk.

So we go the way to get the SecurityContextHolder in pure spring code. While Zksample2 is a pure AJAX ONE PAGE application, means you have every time the same web address, most of the spring features are not running for this kind of application.

So we secure what we need to secure with a manual check in the UserWorkspace.java where you'll find a method isAllowed() that searches the GrantedRights string list that are filled for the logged-in user.

For method securing we can do that with the Annotation @Secured that we evaluate by hooking the main zk onEvent method in our BaseControllers.
We know that not all rights are upToDate because it's very very time intensive to to that. Have a look on an old 'not annotate databinded' module, like 'customer' where you can find the manual ckeckRights() method and play with the @Secured annotation. But have a look for that in the customizable single rights list.

Most time that's the reason why some guys are not understand the structure. Please read the chapter in the Zksample2 documentation. We secure not 'Role_Admin' or 'Role_User1' Role_User2' by a fixed declaring in the code. If you need to modify something you must modify the code like the whole samples in the spring security documentation or in the web.

Our solution is customizable.

So we secure a 'rightName' , means a button is not secured with 'Role_Admin', no, a button is secured by its name like 'Customer.Btn.Save'. So we can take this rightName for several groups and RoleNames.
You can read a little bit more here.

best
Stephan

PS: At least. A right in spring-security is only a string in their GrantedRights list . So you must only use existing or write own mechanism to check something against that list.