Spring Security - Authenticate not by IP but by Domain/SubDomain?
java, spring, spring-security
Solution
It's possible to define your own functions beyond the built-in ones that are defined in `SecurityExpressionRoot` and its subclass `WebSecurityExpressionRoot`. You only need to extend the latter, add your own functions that isnpect the `request` object the way you like, and then configure Spring Security to use that instead of the default one (`WebSecurityExpressionRoot`). Here is how:
- Override `DefaultWebSecurityExpressionHandler.createSecurityExpressionRoot()` in a subclass that constructs your own `SecurityExpressionRoot` implementation containing your custom functions.
- Create a bean of this custom handler and make a reference to it with `<expression-handler ref="yourCustomSecurityExpressionRootHandler">` within the `<http>` config element.
Problem
I have a Spring based web service that I want to provide Spring security. Its working and that it can authenticate through USER and ADMIN roles. However I have a new requirement that I need to authenticate a request not of the USER and ADMIN roles but with the subdomain that the request came from. Typically, there is the authentication by IP: ``` <http use-expressions="true"> <intercept-url pattern="/admin*" access="hasRole('admin') and hasIpAddress('192.168.1.0/24')"/> ... </http> ``` However, my case is quite different, I need to authenticate based on domain and subdomain where the request came from. Like: ``` jim.foo.com tim.foo.com ``` Where jim.foo.com and tim.foo.com have the same IP address. And each subdomain gets authenticated separately. Is it possible?