WebSecurityConfig.java 文件源码

/**
 * Decide.
 *
 * @param authentication
 *            the authentication
 * @param object
 *            the object
 * @param configAttributes
 *            the configuration attributes
 * @throws AccessDeniedException
 *             the access denied exception
 * @throws InsufficientAuthenticationException
 *             the insufficient authentication exception
 */
@Override
public void decide(final Authentication authentication, final Object object, final Collection<ConfigAttribute> configAttributes)
        throws AccessDeniedException, InsufficientAuthenticationException {

    boolean allowAccess = false;

    for (final GrantedAuthority grantedAuthority : authentication.getAuthorities()) {

        for (final ConfigAttribute attribute : configAttributes) {
            allowAccess = attribute.getAttribute().equals(grantedAuthority.getAuthority());
            if (allowAccess) {
                break;// this loop
            }
        }

    }

    if (!allowAccess) {
        throw new AccessDeniedException("Access is denied");
    }
}