Spring Reactive Security | How to implement a reactive PermissionEvaluator - spring-security

Question

Assuming we got an annotated rest controller method with:
#PreAuthorize("hasPermission(#username, 'USER_PROFILE', 'WRITE')")
In Spring MVC we would implement a PermissionEvaluator to implement the authorization hidden behind the following method signature
boolean hasPermission(
Authentication authentication,
Serializable targetId,
String targetType,
Object permission
)
This still seems to work when using Spring WebFlux as long as you do not need to call a reactive service/method inside of the hasPermission method, which I guess is rarely the case since you would typically like to use the reactive interface for your database layer as well. If you would call a reactive service inside this method anyway you would need to call block() on some Mono at some time and thereby run into trouble since you are called from within a reactive pipeline.
In the tutorial from Josh Long about Security with Spring WebFlux he explains how to implement authorization directly on the SecurityWebFilterchain using path matchers by providing custom ReactiveAuthorizationManagers. But there is no explanation of how to use the PreAuthorize annotation in Spring WebFlux.
I was expecting to implement some ReactivePermissionEvaluator
Mono<Boolean> hasPermission(
Authentication authentication,
Serializable targetId,
String targetType,
Object permission
)
that would allow using reactive services in the implementation as well but I wasn't able to find any implementation of the ReactiveAuthorizationManager that would scan for the PreAuthorize annotation and dispatch the evalutation to a reactive PermissionEvaluator nor does the ReactivePermissionEvaluator interface exist.
So finally the question is, how to implement a reactive PermissionEvaluator that allows calling a reactive service, e.g. to query the database for the autorization information without blocking?

Answer 1

Sadly... this is not yet supported by Spring Security in https://github.com/spring-projects/spring-security/issues/5046

Answer 2

Here is how you should do it. Just get DefaultMethodSecurityExpressionHandler bean from applicationContext and explicitly replace permissionsEvaluator.
#Configuration
#EnableWebFluxSecurity
#EnableReactiveMethodSecurity
public class SecurityConfiguration {
#Autowire
private ApplicationContext applicationContext;
#Bean
#DependsOn({"methodSecurityExpressionHandler"})
public SecurityWebFilterChain springSecurityFilterChain(
ServerHttpSecurity http) {
DefaultMethodSecurityExpressionHandler defaultWebSecurityExpressionHandler = this.applicationContext.getBean(DefaultMethodSecurityExpressionHandler.class);
defaultWebSecurityExpressionHandler.setPermissionEvaluator(permissionEvaluator());
return http.csrf().disable()
.httpBasic().disable()
.formLogin().disable()
.logout().disable()
.securityContextRepository(NoOpServerSecurityContextRepository.getInstance())
.addFilterAt(tokenAuthenticationFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
.authorizeExchange()
.anyExchange().authenticated()
.and().build();
}
PermissionEvaluator permissionEvaluator() {
return new PermissionEvaluator() {
#Override
public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
//Custom logic to evaluate #PreAuthorize("hasPermission('123', '123')")
return false;
}
#Override
public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
//Custom logic to evaluate #PreAuthorize("hasPermission('123', '123','123')")
return false;
}
};
}