org.springframework.security.core.parameters

Class AnnotationParameterNameDiscoverer

java.lang.Object

org.springframework.security.core.parameters.AnnotationParameterNameDiscoverer

All Implemented Interfaces:

ParameterNameDiscoverer

public class AnnotationParameterNameDiscoverer
extends Object
implements ParameterNameDiscoverer

Allows finding parameter names using the value attribute of any number of Annotation instances. This is useful when needing to discover the parameter names of interfaces with Spring Security's method level security. For example, consider the following:

 import org.springframework.security.access.method.P;

  @PostAuthorize("#to == returnObject.to")
 public Message findMessageByTo(@P("to") String to);
 

We can make this possible using the following AnnotationParameterNameDiscoverer :

 ParameterAnnotationsNameDiscoverer discoverer = new ParameterAnnotationsNameDiscoverer(
                "org.springframework.security.access.method.P");
 

It is common for users to use AnnotationParameterNameDiscoverer in conjuction with PrioritizedParameterNameDiscoverer. In fact, Spring Security's DefaultSecurityParameterNameDiscoverer (which is used by default with method level security) extends PrioritizedParameterNameDiscoverer and will automatically support both P and Spring Data's Param annotation if it is found on the classpath.

It is important to note that if a single parameter name has a supported annotation on it then all methods are resolved using AnnotationParameterNameDiscoverer. For example, consider the following:

 import org.springframework.security.access.method.P;

  @PostAuthorize("#to == returnObject.to")
 public Message findMessageByToAndFrom(@P("to") User to, User from);
 

The result of finding parameters on the previous sample will be new String[] { "to", null} since only a single parameter contains an annotation. This is mostly due to the fact that the fallbacks for PrioritizedParameterNameDiscoverer are an all or nothing operation.

Since:

3.2

Author:

Rob Winch

See Also:

DefaultSecurityParameterNameDiscoverer

Constructor Summary

Constructors

Constructor and Description
AnnotationParameterNameDiscoverer(Set<String> annotationClassesToUse)
AnnotationParameterNameDiscoverer(String... annotationClassToUse)

Method Summary

Modifier and Type	Method and Description
String[]	getParameterNames(Constructor<?> constructor)
String[]	getParameterNames(Method method)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AnnotationParameterNameDiscoverer

public AnnotationParameterNameDiscoverer(String... annotationClassToUse)

AnnotationParameterNameDiscoverer

public AnnotationParameterNameDiscoverer(Set<String> annotationClassesToUse)

Method Detail

getParameterNames

public String[] getParameterNames(Method method)

Specified by:

getParameterNames in interface ParameterNameDiscoverer

getParameterNames

public String[] getParameterNames(Constructor<?> constructor)

Specified by:

getParameterNames in interface ParameterNameDiscoverer