Custom permission evaluator in Spring Boot - Step-by-Step Execution

Concept Flow - Custom permission evaluator

User requests access

↓

Security checks permission

↓

Call CustomPermissionEvaluator

↓

Evaluate permission logic

↓

Return true: Access granted

↓

Return false: Access denied

When a user requests access, Spring Security calls the custom permission evaluator to check if the user has the required permission and returns true or false.

Execution Sample

Spring Boot

public class CustomPermissionEvaluator implements PermissionEvaluator {
  @Override
  public boolean hasPermission(Authentication auth, Object target, Object perm) {
    // custom logic
    return true; // or false
  }

  @Override
  public boolean hasPermission(Authentication auth, Serializable targetId, String targetType, Object perm) {
    // custom logic for this method if needed
    return false;
  }
}

This code defines a custom permission evaluator that Spring Security uses to decide if a user has permission.

Execution Table

Step	Input Parameters	Permission Check Logic	Result	Access Outcome
1	auth=UserA, target=Document1, perm='read'	Check if UserA has 'read' on Document1	true	Access granted
2	auth=UserB, target=Document1, perm='write'	Check if UserB has 'write' on Document1	false	Access denied
3	auth=UserA, target=Document2, perm='delete'	Check if UserA has 'delete' on Document2	false	Access denied
4	auth=Admin, target=Any, perm='all'	Admin has all permissions	true	Access granted

💡 Permission evaluator returns true or false to grant or deny access

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
auth	null	UserA	UserB	UserA	Admin
target	null	Document1	Document1	Document2	Any
perm	null	'read'	'write'	'delete'	'all'
result	null	true	false	false	true

Key Moments - 3 Insights

Why does the permission evaluator return false even if the user is authenticated?

Authentication means the user is logged in, but permission evaluator checks if the user has rights to the specific action on the target. See execution_table rows 2 and 3 where users are authenticated but lack permission.

What happens if the permission evaluator returns true?

Access is granted to the user for the requested action. This is shown in execution_table rows 1 and 4 where result is true and access is granted.

Can the permission evaluator check complex rules?

Yes, it can use any logic inside hasPermission method to decide. The flow in concept_flow shows the evaluator can return true or false based on custom logic.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result of permission check for UserB trying to 'write' Document1?

A false

B true

C null

D throws error

💡 Hint

Check execution_table row 2 under 'Result' column

At which step does the permission evaluator grant access for an admin user?

A Step 1

B Step 4

C Step 3

D Step 2

💡 Hint

Look at execution_table row 4 for 'auth' and 'Access Outcome'

If the permission evaluator always returns true, what changes in variable_tracker 'result' row?

A Values alternate true and false

B All values become false

C All values become true

D Values remain null

💡 Hint

Consider the 'result' values in variable_tracker and what always returning true means

Concept Snapshot

Custom Permission Evaluator in Spring Security:
- Implement PermissionEvaluator interface
- Override hasPermission method
- Use Authentication, target, and permission parameters
- Return true to grant access, false to deny
- Enables custom access rules beyond roles

Full Transcript

In Spring Security, a custom permission evaluator checks if a user has permission to perform an action on a target object. When a user requests access, the security system calls the custom evaluator's hasPermission method with the user's authentication, the target object, and the requested permission. The evaluator runs custom logic and returns true or false. True means access granted, false means denied. The execution table shows examples with different users and permissions. Variables like auth, target, perm, and result change as the evaluator runs. Key moments clarify that authentication alone doesn't guarantee permission, and the evaluator can implement complex rules. The visual quiz tests understanding of permission results and outcomes. This approach lets developers control access precisely in their Spring Boot apps.