궁금한 점이있습니다.

커스텀하다가 궁금하여 질문드립니다.

private List<AccessDecisionVoter<?>> getAccessDecisionVoters() {

    List<AccessDecisionVoter<? extends Object>> accessDecisionVoters = new ArrayList<>();

    accessDecisionVoters.add(accessIp());
    accessDecisionVoters.add(roleVoter());
    accessDecisionVoters.add(groupVoter());

    return accessDecisionVoters;
}

@Bean
public AccessDecisionVoter<? extends Object> accessIp() {
    return new IpAddressVoter(securityResourceService);
}

@Bean
public AccessDecisionVoter<? extends Object> roleVoter() {
    return new CustomRoleHierarchyVoter(roleHierarchy());
}

@Bean
public RoleHierarchy roleHierarchy() {
    return new RoleHierarchyImpl();
}

@Bean
public AccessDecisionVoter<? extends Object> groupVoter() {
    return new GroupVoter(roleGroupHierarchy());
}

@Bean
public RoleHierarchy roleGroupHierarchy() {
    return new RoleHierarchyImpl();
}

CustomRoleHierarchyVoter 

-  기존 RoleVoter에서 승인 처리되는 부분을 보류 상태로 변경했습니다.

public class CustomRoleHierarchyVoter extends RoleHierarchyVoter {

    public CustomRoleHierarchyVoter(RoleHierarchy roleHierarchy) {
        super(roleHierarchy);
    }

    @Override
    public int vote(Authentication authentication, Object object,
        Collection<ConfigAttribute> attributes) {
        if (authentication == null) {
            return ACCESS_DENIED;
        }
        Collection<? extends GrantedAuthority> authorities = extractAuthorities(authentication);
        for (ConfigAttribute attribute : attributes) {
            if (this.supports(attribute)) {
                // Attempt to find a matching granted authority
                for (GrantedAuthority authority : authorities) {
                    if (attribute.getAttribute().equals(authority.getAuthority())) {
                        return ACCESS_ABSTAIN;
                    }
                }
            }
        }
        return ACCESS_DENIED;
    }

    Collection<? extends GrantedAuthority> extractAuthorities(Authentication authentication) {
        return authentication.getAuthorities();
    }
}

GroupVoter

- 그룹 정보에 따른 승인 처리 부분입니다. 

해당 부분에서 그냥 DB 정보를 가져와서 Map에다가 저장해서 처리해볼까 하는 생각도 있는데 확실치가 않네요 .. 

public class GroupVoter extends RoleHierarchyVoter {

    public GroupVoter(RoleHierarchy roleHierarchy) {
        super(roleHierarchy);
    }

    @Override
    public int vote(Authentication authentication, Object object,
        Collection<ConfigAttribute> attributes) {
        // 미구현 
        return result;
    }
}