How to immediately enable the authority after update user authority in spring security?

Question

Hi,

I'm using spring-security framework.When I update the permissions,It does not take effect immediately.I have to quit the current user(means logout), and then re-visit(means login) will be to update the user's permission.

Is a way that immediately enable the authority after update user authority in spring security?

Answer 1

Since you didn't quite provide the exact details in your question, I assume that you have a situation where:

1. You are supplying a UserDetailsService to load up a UserDetails when a user attempts to login
2. As a part of that service, you are querying a database/DAO to load up details about a user's permissions, and are setting the granted authorities based on this
3. That when you say "When I update the permissions" you are referring to updating the user's permissions in the database (or whatever you are storing data in).

If so then what you are seeing is by design - Spring Security only loads the UserDetails for the user the first time, when they attempt to login, and then stores it in Session from then on. Generally this makes sense, as it avoids the application from having to perform the same queries about user details on each request. Also, a user's permissions are generally not changing throughout 99.9% of their visits.

To change this behavior, you might want to look into adding a "refresh" command/page somewhere that will trigger some code (which you will have to write) which will re-query the UserDetailsService and replace the UserDetails in SecurityContext. I don't believe there is any built-in way to do this.

Answer 2

One possible solution is described in Adjusting secured session in real time post on Spring Source blog.

Answer 3

You could create your own implementation of the UserDetails interface that is returned from your authentication mechanism, that allows access to the GrantedAuthorities[]. Then add your new authority directly to that UserDetails object. You may run into issues if a user can have multiple sessions open at once (or if multiple users share the same generic login), that the new permissions will only be seen on the session you have altered.