Polish AuthorizationManager Method Security

- Removed consolidated pointcut advisor in favor of each interceptor
being an advisor. This allows Spring AOP to do more of the heavy
lifting of selecting the set of interceptors that applies
- Created new method context for after interceptors instead of
modifying existing one
- Added documentation
- Added XML support
- Added AuthorizationInterceptorsOrder to simplify interceptor
ordering
- Adjusted annotation lookup to comply with JSR-250 spec
- Adjusted annotation lookup to exhaustively search for duplicate
annotations
- Separated into three @configuration classes, one for each set of
authorization annotations

Issue gh-9289

Author: jzheaux

config/src/main/java/org/springframework/security/config/Elements.java

@@ -87,6 +87,8 @@ public abstract class Elements {
 
 	public static final String GLOBAL_METHOD_SECURITY = "global-method-security";
 
+	public static final String METHOD_SECURITY = "method-security";
+
 	public static final String PASSWORD_ENCODER = "password-encoder";
 
 	public static final String PORT_MAPPINGS = "port-mappings";

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -44,6 +44,7 @@
 import org.springframework.security.config.ldap.LdapUserServiceBeanDefinitionParser;
 import org.springframework.security.config.method.GlobalMethodSecurityBeanDefinitionParser;
 import org.springframework.security.config.method.InterceptMethodsBeanDefinitionDecorator;
+import org.springframework.security.config.method.MethodSecurityBeanDefinitionParser;
 import org.springframework.security.config.method.MethodSecurityMetadataSourceBeanDefinitionParser;
 import org.springframework.security.config.oauth2.client.ClientRegistrationsBeanDefinitionParser;
 import org.springframework.security.config.websocket.WebSocketMessageBrokerSecurityBeanDefinitionParser;
@@ -169,6 +170,7 @@ private void loadParsers() {
 		this.parsers.put(Elements.JDBC_USER_SERVICE, new JdbcUserServiceBeanDefinitionParser());
 		this.parsers.put(Elements.AUTHENTICATION_PROVIDER, new AuthenticationProviderBeanDefinitionParser());
 		this.parsers.put(Elements.GLOBAL_METHOD_SECURITY, new GlobalMethodSecurityBeanDefinitionParser());
+		this.parsers.put(Elements.METHOD_SECURITY, new MethodSecurityBeanDefinitionParser());
 		this.parsers.put(Elements.AUTHENTICATION_MANAGER, new AuthenticationManagerBeanDefinitionParser());
 		this.parsers.put(Elements.METHOD_SECURITY_METADATA_SOURCE,
 				new MethodSecurityMetadataSourceBeanDefinitionParser());

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableMethodSecurity.java

@@ -25,13 +25,17 @@
 import org.springframework.context.annotation.AdviceMode;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
-import org.springframework.core.Ordered;
 import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.prepost.PostAuthorize;
+import org.springframework.security.access.prepost.PostFilter;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.access.prepost.PreFilter;
 
 /**
  * Enables Spring Security Method Security.
  * @author Evgeniy Cheban
- * @since 5.5
+ * @author Josh Cummings
+ * @since 5.6
  */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.TYPE)
@@ -40,6 +44,14 @@
 @Configuration
 public @interface EnableMethodSecurity {
 
+	/**
+	 * Determines if Spring Security's {@link PreAuthorize}, {@link PostAuthorize},
+	 * {@link PreFilter}, and {@link PostFilter} annotations should be enabled. Default is
+	 * true.
+	 * @return true if pre/post annotations should be enabled false otherwise
+	 */
+	boolean prePostEnabled() default true;
+
 	/**
 	 * Determines if Spring Security's {@link Secured} annotation should be enabled.
 	 * Default is false.
@@ -76,12 +88,4 @@
 	 */
 	AdviceMode mode() default AdviceMode.PROXY;
 
-	/**
-	 * Indicate the ordering of the execution of the security advisor when multiple
-	 * advices are applied at a specific joinpoint. The default is
-	 * {@link Ordered#LOWEST_PRECEDENCE}.
-	 * @return the order the security advisor should be applied
-	 */
-	int order() default Ordered.LOWEST_PRECEDENCE;
-
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/Jsr250MethodSecurityConfiguration.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2002-2021 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.config.annotation.method.configuration;
+
+import org.springframework.aop.Advisor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Role;
+import org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor;
+import org.springframework.security.authorization.method.Jsr250AuthorizationManager;
+import org.springframework.security.config.core.GrantedAuthorityDefaults;
+
+/**
+ * {@link Configuration} for enabling JSR-250 Spring Security Method Security.
+ *
+ * @author Evgeniy Cheban
+ * @author Josh Cummings
+ * @see EnableMethodSecurity
+ * @since 5.6
+ */
+@Configuration(proxyBeanMethods = false)
+@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
+final class Jsr250MethodSecurityConfiguration {
+
+	private final Jsr250AuthorizationManager jsr250AuthorizationManager = new Jsr250AuthorizationManager();
+
+	@Bean
+	@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
+	Advisor jsr250AuthorizationMethodInterceptor() {
+		return AuthorizationManagerBeforeMethodInterceptor.jsr250(this.jsr250AuthorizationManager);
+	}
+
+	@Autowired(required = false)
+	void setGrantedAuthorityDefaults(GrantedAuthorityDefaults grantedAuthorityDefaults) {
+		this.jsr250AuthorizationManager.setRolePrefix(grantedAuthorityDefaults.getRolePrefix());
+	}
+
+}