Spring Security - Third Edition

Creating a custom PermissionEvaluator

In the previous chapter, we demonstrated that we could use Spring Security's built-in PermissionEvaluator implementation, AclPermissionEvaluator, to restrict access to our application. While powerful, this can often be more complicated than necessary. We have also discovered how SpEL can formulate complex expressions that are able to secure our application. While simple, one of the downsides of using complex expressions is that the logic is not centralized. Fortunately, we can easily create a custom PermissionEvaluator that is able to centralize our authorization logic and still avoid the complexity of using ACLs.