Wanting a custom ExpressionInterceptURL to dynamically manage access to URLs - spring-security

Question

We have information packs at URLs which need a user right to access, laid out as:
/InfoPacks/InfoPack1/
/InfoPacks/InfoPack2/
etc
A user need ROLE_INFOPACK1 to access the /InfoPacks/InfoPack1/ and ROLE_INFOPACK2 to access the /InfoPacks/InfoPack2/ etc.
We are adding packs all the time so putting adding to WebSecurityConfig() with
.antMatchers("/InfoPacks/InfoPack1/**/*").hasAuthority("ROLE_INFOPACK1)
isnt really a goer as it would imply modifying and re-deploying every time a new pack was created while the configure method in security config got larger and larger.
A custom evaluator would be better. eg something that could call a service with
like:
hasPermission(Authentication auth, String targetURL) {
// search auth.GrantAuthorities for a match to targetURL
}
I see this sort of custom permission expression examples for use with PreAuthorize but doesnt seem to be way to do this with URL authorizeRequests(). (at least in version 4).
Any pointers would be very welcome.

Answer 1

Got it figured out, thanks to http://www.baeldung.com/spring-security-custom-voter.
My web security config now look like:
protected void configure(HttpSecurity http) throws Exception {
http
.headers()
.frameOptions().sameOrigin()
.and()
.csrf().disable()
.exceptionHandling()
.and()
.authorizeRequests()
....
.antMatchers("/Infopacks/**/*").authenticated().accessDecisionManager(accessDecisionManager())
..... etc
}
#SuppressWarnings("unchecked")
#Bean
public AccessDecisionManager accessDecisionManager() {
System.out.println("Arrive AccessDecisionManager");
List<AccessDecisionVoter<? extends Object>> decisionVoters
= Arrays.asList(
new WebExpressionVoter(),
new RoleVoter(),
new AuthenticatedVoter(),
new DynamicVoter());
return new UnanimousBased(decisionVoters);
}
The vote method of DynamicVoter looks (in ugly first test - I know it needs work to plug holes) like:
#Override
public int vote(Authentication a, Object s, Collection clctn) {
String url = ((FilterInvocation) s).getRequestUrl();
int vote = ACCESS_ABSTAIN;
if (url.contains("/Infopack")) {
vote = ACCESS_DENIED;
for (GrantedAuthority ga:a.getAuthorities()) {
if (url.toUpperCase().contains(ga.getAuthority()) ) {
vote = ACCESS_GRANTED;
break;
}
}
}
return vote;
}
The user authorization system thus just needs to add the infopack name as a granted authority to allow user access to the infopack directory. You can add new infopack directories at will without changing the code.