SEC-2105: Automatically select WebInvocationPrivlegeEvaluator for AbstractAuthorizeTag

[spring-projects-issues]

Rob Winch (Migrated from SEC-2105) said:

Currently the AbstractAuthorizeTag will by default use the first WebInvocationPrivlegeEvaluator that is found in the ApplicationContext. This can be overridden using the updates of SEC-2045. However, the correct WebInvocationPrivlegeEvaluator must be set as a request attribute by users right now.

h3. Select WebInvocationPrivlegeEvaluator per

One solution might be to have the WebInvocationPrivlegeEvaluator be injected by a Filter inside each block. However, this approach will not work when the AbstractAuthorizeTag references a URL in another block. For example, given the following configuration:

<http auto-config="true" pattern="/admin/**">
  <intercept-url pattern="/**" access="ROLE_ADMIN"/>
</http>
<http auto-config="true">
  <intercept-url pattern="/**" access="ROLE_USER"/>
</http>

If a user were currently on the page /user and had the following JSP, the proposed solution would not work:

<c:url value="/admin/" var="adminLink"/>
<sec:authorize url="${adminLink}">
  <a href="${adminLink}">Admin</a>
</sec:authorize>

h3. DelegatingWebInvocationPrivlegeEvaluator

Perhaps a more attractive option would be a DelegatingWebInvocationPrivlegeEvaluator which delegates based upon a RequestMatcher. The concept would be very similar to DelegatingAuthenticationEntryPoint.

This still has problems since users may create their own RequestMatcher interface that uses attributes not populated by the AbstractAuthorizeTag. For example, if the first block was used for JSON requests based upon content type, this is not known by the AbstractAuthorizeTag so the RequestMatcher could never match on it.