Question

I want to secure a new client server system based on spring with spring-security and (preferably) method-based security annotations.

there are many spring examples for web-apps but so far i didn’t find one for non-web java apps.

Basicly i want to handle security for a netty socket in a way that is transparent for my management beans. For example: authenticate the user of the connection once in a netty handler and leave the complete authorization to spring-security and the annotations on my management beans.

is something like this possible?

EDIT

i found an example that uses spring-security in junit integration tests
i guess i could do it like that but i wouldn’t be able to use IoC for my facades so i’m not that fond of the idea.

Answer 1

Spring Security supports authentication handling at the method level using annotations. You could try the @PreAuthorize annotation as described in “Access Control using @PreAuthorize and @PostAuthorize” – though I am unsure on how to get the proper security context in place before the method is called.