spring-security: authorization without authentication

Question

I\'m trying to integrate Spring Security in my web application. It seems pretty easy to do as long as you integrate the whole process of authentication and authorization.

Answer 1

I use the authorization by this:

1. Inject the authorization related bean into my own bean:

   @Autowired
   private AccessDecisionManager    accessDecisionManager;
   @Autowired
   FilterSecurityInterceptor        filterSecurityInterceptor;
   

2. Use this bean by this:

   FilterInvocation fi = new FilterInvocation(rundata.getRequest(), rundata.getResponse(), new FilterChain() {
   
       public void doFilter(ServletRequest arg0, ServletResponse arg1) throws IOException, ServletException {
           // TODO Auto-generated method stub
   
       }
   });
   FilterInvocationDefinitionSource objectDefinitionSource = filterSecurityInterceptor.getObjectDefinitionSource();
   ConfigAttributeDefinition attr = objectDefinitionSource.getAttributes(fi);
   Authentication authenticated = new Authentication() {
   
       ...........
   
       public GrantedAuthority[] getAuthorities() {
           GrantedAuthority[] result = new GrantedAuthority[1];
           result[0] = new GrantedAuthorityImpl("ROLE_USER");
           return result;
       }
   };
   accessDecisionManager.decide(authenticated, fi, attr);