Package org.springframework.security.access.intercept

# Class AbstractSecurityInterceptor

java.lang.Object
org.springframework.security.access.intercept.AbstractSecurityInterceptor

All Implemented Interfaces:
  `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.ApplicationEventPublisherAware`, `org.springframework.context.MessageSourceAware`

Direct Known Subclasses:
  `MethodSecurityInterceptor`

@Deprecated public abstract class AbstractSecurityInterceptor extends Object implements org.springframework.beans.factory.InitializingBean, org.springframework.context.ApplicationEventPublisherAware, org.springframework.context.MessageSourceAware
Deprecated.
Use `org.springframework.security.web.access.intercept.AuthorizationFilter` instead for filter security, `org.springframework.security.messaging.access.intercept.AuthorizationChannelInterceptor` for messaging security, or `AuthorizationManagerBeforeMethodInterceptor` and `AuthorizationManagerAfterMethodInterceptor` for method security.
Abstract class that implements security interception for secure objects.

The `AbstractSecurityInterceptor` will ensure the proper startup configuration of the security interceptor. It will also implement the proper handling of secure object invocations, namely:

1. Obtain the `Authentication` object from the `SecurityContextHolder`.
2. Determine if the request relates to a secured or public invocation by looking up the secure object request against the `SecurityMetadataSource`.
3. For an invocation that is secured (there is a list of `ConfigAttribute`s for the secure object invocation):
   1. If either the `Authentication.isAuthenticated()` returns `false`, or the `alwaysReauthenticate` is `true`, authenticate the request against the configured `AuthenticationManager`. When authenticated, replace the `Authentication` object on the `SecurityContextHolder` with the returned value.
   2. Authorize the request against the configured `AccessDecisionManager`.
   3. Perform any run-as replacement via the configured `RunAsManager`.
   4. Pass control back to the concrete subclass, which will actually proceed with executing the object. A `InterceptorStatusToken` is returned so that after the subclass has finished proceeding with execution of the object, its finally clause can ensure the `AbstractSecurityInterceptor` is re-called and tidies up correctly using `finallyInvocation(InterceptorStatusToken)`.
   5. The concrete subclass will re-call the `AbstractSecurityInterceptor` via the `afterInvocation(InterceptorStatusToken, Object)` method.
   6. If the `RunAsManager` replaced the `Authentication` object, return the `SecurityContextHolder` to the object that existed after the call to `AuthenticationManager`.
   7. If an `AfterInvocationManager` is defined, invoke the invocation manager and allow it to replace the object due to be returned to the caller.
4. For an invocation that is public (there are no `ConfigAttribute`s for the secure object invocation):
   1. As described above, the concrete subclass will be returned an `InterceptorStatusToken` which is subsequently re-presented to the `AbstractSecurityInterceptor` after the secure object has been executed. The `AbstractSecurityInterceptor` will take no further action when its `afterInvocation(InterceptorStatusToken, Object)` is called.
5. Control again returns to the concrete subclass, along with the `Object` that should be returned to the caller. The subclass will then return that result or exception to the original caller.

## Field Summary

Fields
Modifier and Type
Field
Description
`protected final org.apache.commons.logging.Log`
`logger`
Deprecated.
`protected org.springframework.context.support.MessageSourceAccessor`
`messages`
Deprecated.

## Constructor Summary

Constructors
Constructor
Description
`AbstractSecurityInterceptor()`
Deprecated.

## Method Summary

Modifier and Type
Method
Description
`protected Object`
`afterInvocation(InterceptorStatusToken token, Object returnedObject)`
Deprecated.
Completes the work of the `AbstractSecurityInterceptor` after the secure object invocation has been completed.
`void`
`afterPropertiesSet()`
Deprecated.
`protected InterceptorStatusToken`
`beforeInvocation(Object object)`
Deprecated.
`protected void`
`finallyInvocation(InterceptorStatusToken token)`
Deprecated.
Cleans up the work of the `AbstractSecurityInterceptor` after the secure object invocation has been completed.
`AccessDecisionManager`
`getAccessDecisionManager()`
Deprecated.
`AfterInvocationManager`
`getAfterInvocationManager()`
Deprecated.
`AuthenticationManager`
`getAuthenticationManager()`
Deprecated.
`RunAsManager`
`getRunAsManager()`
Deprecated.
`abstract Class<?>`
`getSecureObjectClass()`
Deprecated.
Indicates the type of secure objects the subclass will be presenting to the abstract parent for processing.
`boolean`
`isAlwaysReauthenticate()`
Deprecated.
`boolean`
`isRejectPublicInvocations()`
Deprecated.
`boolean`
`isValidateConfigAttributes()`
Deprecated.
`abstract SecurityMetadataSource`
`obtainSecurityMetadataSource()`
Deprecated.
`void`
`setAccessDecisionManager(AccessDecisionManager accessDecisionManager)`
Deprecated.
`void`
`setAfterInvocationManager(AfterInvocationManager afterInvocationManager)`
Deprecated.
`void`
`setAlwaysReauthenticate(boolean alwaysReauthenticate)`
Deprecated.
Indicates whether the `AbstractSecurityInterceptor` should ignore the `Authentication.isAuthenticated()` property.
`void`
`setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher applicationEventPublisher)`
Deprecated.
`void`
`setAuthenticationManager(AuthenticationManager newManager)`
Deprecated.
`void`
`setMessageSource(org.springframework.context.MessageSource messageSource)`
Deprecated.
`void`
`setPublishAuthorizationSuccess(boolean publishAuthorizationSuccess)`
Deprecated.
Only `AuthorizationFailureEvent` will be published.
`void`
`setRejectPublicInvocations(boolean rejectPublicInvocations)`
Deprecated.
By rejecting public invocations (and setting this property to `true`), essentially you are ensuring that every secure object invocation advised by `AbstractSecurityInterceptor` has a configuration attribute defined.
`void`
`setRunAsManager(RunAsManager runAsManager)`
Deprecated.
`void`
`setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy)`
Deprecated.
Sets the `SecurityContextHolderStrategy` to use.
`void`
`setValidateConfigAttributes(boolean validateConfigAttributes)`
Deprecated.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### logger

protected final org.apache.commons.logging.Log logger
Deprecated.

### messages

protected org.springframework.context.support.MessageSourceAccessor messages
Deprecated.

## Constructor Details

### AbstractSecurityInterceptor

public AbstractSecurityInterceptor()
Deprecated.

## Method Details

### afterPropertiesSet

public void afterPropertiesSet()
Deprecated.

Specified by:
  `afterPropertiesSet` in interface `org.springframework.beans.factory.InitializingBean`

### beforeInvocation

protected InterceptorStatusToken beforeInvocation(Object object)
Deprecated.

### finallyInvocation

protected void finallyInvocation(InterceptorStatusToken token)
Deprecated.
Cleans up the work of the `AbstractSecurityInterceptor` after the secure object invocation has been completed. This method should be invoked after the secure object invocation and before afterInvocation regardless of the secure object invocation returning successfully (i.e. it should be done in a finally block).

Parameters:
  `token` - as returned by the `beforeInvocation(Object)` method

### afterInvocation

protected Object afterInvocation(InterceptorStatusToken token, Object returnedObject)
Deprecated.
Completes the work of the `AbstractSecurityInterceptor` after the secure object invocation has been completed.

Parameters:
  `token` - as returned by the `beforeInvocation(Object)` method
  `returnedObject` - any object returned from the secure object invocation (may be `null`)
Returns:
  the object the secure object invocation should ultimately return to its caller (may be `null`)

### getAccessDecisionManager

public AccessDecisionManager getAccessDecisionManager()
Deprecated.

### getAfterInvocationManager

public AfterInvocationManager getAfterInvocationManager()
Deprecated.

### getAuthenticationManager

public AuthenticationManager getAuthenticationManager()
Deprecated.

### getRunAsManager

public RunAsManager getRunAsManager()
Deprecated.

### getSecureObjectClass

public abstract Class<?> getSecureObjectClass()
Deprecated.
Indicates the type of secure objects the subclass will be presenting to the abstract parent for processing. This is used to ensure collaborators wired to the `AbstractSecurityInterceptor` all support the indicated secure object class.

Returns:
  the type of secure object the subclass provides services for

### isAlwaysReauthenticate

public boolean isAlwaysReauthenticate()
Deprecated.

### isRejectPublicInvocations

public boolean isRejectPublicInvocations()
Deprecated.

### isValidateConfigAttributes

public boolean isValidateConfigAttributes()
Deprecated.

### obtainSecurityMetadataSource

public abstract SecurityMetadataSource obtainSecurityMetadataSource()
Deprecated.

### setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy)
Deprecated.
Sets the `SecurityContextHolderStrategy` to use. The default action is to use the `SecurityContextHolderStrategy` stored in `SecurityContextHolder`.

Since:
  5.8

### setAccessDecisionManager

public void setAccessDecisionManager(AccessDecisionManager accessDecisionManager)
Deprecated.

### setAfterInvocationManager

public void setAfterInvocationManager(AfterInvocationManager afterInvocationManager)
Deprecated.

### setAlwaysReauthenticate

public void setAlwaysReauthenticate(boolean alwaysReauthenticate)
Deprecated.
Indicates whether the `AbstractSecurityInterceptor` should ignore the `Authentication.isAuthenticated()` property. Defaults to `false`, meaning by default the `Authentication.isAuthenticated()` property is trusted and re-authentication will not occur if the principal has already been authenticated.

Parameters:
  `alwaysReauthenticate` - `true` to force `AbstractSecurityInterceptor` to disregard the value of `Authentication.isAuthenticated()` and always re-authenticate the request (defaults to `false`).

### setApplicationEventPublisher

public void setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher applicationEventPublisher)
Deprecated.

Specified by:
  `setApplicationEventPublisher` in interface `org.springframework.context.ApplicationEventPublisherAware`

### setAuthenticationManager

public void setAuthenticationManager(AuthenticationManager newManager)
Deprecated.

### setMessageSource

public void setMessageSource(org.springframework.context.MessageSource messageSource)
Deprecated.

Specified by:
  `setMessageSource` in interface `org.springframework.context.MessageSourceAware`

### setPublishAuthorizationSuccess

public void setPublishAuthorizationSuccess(boolean publishAuthorizationSuccess)
Deprecated.
Only `AuthorizationFailureEvent` will be published. If you set this property to `true`, `AuthorizedEvent`s will also be published.

Parameters:
  `publishAuthorizationSuccess` - default value is `false`

### setRejectPublicInvocations

public void setRejectPublicInvocations(boolean rejectPublicInvocations)
Deprecated.
By rejecting public invocations (and setting this property to `true`), essentially you are ensuring that every secure object invocation advised by `AbstractSecurityInterceptor` has a configuration attribute defined. This is useful to ensure a "fail safe" mode where undeclared secure objects will be rejected and configuration omissions detected early. An `IllegalArgumentException` will be thrown by the `AbstractSecurityInterceptor` if you set this property to `true` and an attempt is made to invoke a secure object that has no configuration attributes.

Parameters:
  `rejectPublicInvocations` - set to `true` to reject invocations of secure objects that have no configuration attributes (by default it is `false` which treats undeclared secure objects as "public" or unauthorized).

### setRunAsManager

public void setRunAsManager(RunAsManager runAsManager)
Deprecated.

### setValidateConfigAttributes

public void setValidateConfigAttributes(boolean validateConfigAttributes)
Deprecated.