Legacy Authorization Components

In this section, we will take a closer look at certain authorization components that existed in Spring Security but have been deprecated with the introduction of Spring Security 6.

The AccessDecisionManager

The AbstractSecurityInterceptor invokes the AccessDecisionManager, which is tasked with making conclusive access control decisions. The AccessDecisionManager interface encompasses three methods:

void decide(Authentication authentication, Object secureObject,
       Collection<ConfigAttribute> attrs) throws AccessDeniedException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz);

The decide method of the AccessDecisionManager receives all the pertinent information required to make an authorization decision. Specifically, passing the secure object allows the inspection of arguments within the actual invocation of the secure object. For instance, if the secure object is a MethodInvocation...