PrePostMethodSecurityConfiguration ignores custom PermissionEvaluator #45675
Description
Problem:
I try to use a custom PermissionEvaluator in PreAuthorize- and PostAuthorize SpEL with the delegating hasPermission(). The bean is registered but not used, instead the default DenyAllPermissionEvaluator is still used.
Investigation:
Looking into the code I find the deprecated GlobalMethodSecurityConfiguration would configure a custom PermissionEvaluator bean (see afterSingletonsInstantiated()) but it is deprecated and no longer used by auto configuration and the new PrePostMethodSecurityConfiguration ignores the existence of such a bean.
Solution Idea:
final class PrePostMethodSecurityConfiguration {
@Autowired(required = false)
void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
}
}