yakworks · basejump · Sep 30, 2025 · Sep 30, 2025 · Sep 30, 2025 · Sep 30, 2025
diff --git a/...les/hello-boot-security/src/main/groovy/yakity/security/HelloSecurityConfiguration.groovy b/...les/hello-boot-security/src/main/groovy/yakity/security/HelloSecurityConfiguration.groovy
@@ -28,7 +28,7 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
 import org.springframework.security.web.SecurityFilterChain
 
 import yakworks.security.spring.DefaultSecurityConfiguration
-import yakworks.security.spring.WildcardAuthorizationManager
+import yakworks.security.spring.PermissionsAuthorizationManager
 import yakworks.security.spring.token.store.TokenStore
 
 import static org.springframework.security.config.Customizer.withDefaults
@@ -49,17 +49,12 @@ class HelloSecurityConfiguration {
     @Autowired(required = false) TokenStore tokenStore;
 
     @Bean
-    WildcardAuthorizationManager wildcardAuthorizationManager() {
-        return new WildcardAuthorizationManager()
-    }
-
-    @Bean
-    SecurityFilterChain securityFilterChain(HttpSecurity http, WildcardAuthorizationManager wildcardAuthorizationManager) throws Exception {
+    SecurityFilterChain securityFilterChain(HttpSecurity http, PermissionsAuthorizationManager permissionsAuthorizationManager) throws Exception {
         // DefaultSecurityConfiguration.applyBasicDefaults(http)
         http
             .authorizeHttpRequests((authorize) -> authorize
                 .requestMatchers("/actuator/**", "/resources/**", "/about").permitAll()
-                .requestMatchers("/api/**").access(wildcardAuthorizationManager)
+                .requestMatchers("/api/**").access(permissionsAuthorizationManager)
                 .anyRequest().authenticated()
 
             )

diff --git a/examples/rally-api/src/main/groovy/yakworks/rally/config/RallyApiSpringConfiguration.groovy b/examples/rally-api/src/main/groovy/yakworks/rally/config/RallyApiSpringConfiguration.groovy
@@ -24,15 +24,15 @@ import yakworks.rally.RallyConfiguration
 import yakworks.rally.api.TestTimeoutQueryArgsValidator
 import yakworks.rest.grails.AppInfoBuilder
 import yakworks.security.spring.DefaultSecurityConfiguration
-import yakworks.security.spring.WildcardAuthorizationManager
+import yakworks.security.spring.PermissionsAuthorizationManager
 import yakworks.security.spring.token.CookieAuthSuccessHandler
 import yakworks.security.spring.token.CookieUrlTokenSuccessHandler
 import yakworks.security.spring.token.TokenUtils
 import yakworks.security.spring.token.generator.JwtTokenGenerator
 import yakworks.security.spring.token.store.TokenStore
 
 import static org.springframework.security.config.Customizer.withDefaults
-import static org.springframework.security.web.util.matcher.AntPathRequestMatcher.antMatcher
+
 /**
  * An example of explicitly configuring Spring Security with the defaults.
  */
@@ -57,7 +57,7 @@ class RallyApiSpringConfiguration {
     @Autowired TokenStore tokenStore
 
     @Bean
-    SecurityFilterChain securityFilterChain(HttpSecurity http, WildcardAuthorizationManager wildcardAuthorizationManager) throws Exception {
+    SecurityFilterChain securityFilterChain(HttpSecurity http, PermissionsAuthorizationManager permissionsAuthorizationManager) throws Exception {
         //var sth = new SubjectThreadState(null);
         //defaults permit all
         List permitAllMatchers = [
@@ -84,7 +84,7 @@ class RallyApiSpringConfiguration {
                 .requestMatchers("/security-tests/error403").hasRole("SUPER_DUPER")
                 .requestMatchers(permitAllMatchers as String[]).permitAll()
                 .requestMatchers("/validate").authenticated()
-                .anyRequest().access(wildcardAuthorizationManager)
+                .anyRequest().access(permissionsAuthorizationManager)
             )
             // http basic auth
             .httpBasic(withDefaults())
@@ -140,11 +140,6 @@ class RallyApiSpringConfiguration {
         return new TestTimeoutQueryArgsValidator()
     }
 
-    @Bean
-    WildcardAuthorizationManager wildcardAuthorizationManager() {
-        return new WildcardAuthorizationManager()
-    }
-
     // @Bean @Lazy(false)
     // WebMvcRegistrations webMvcRegistrations() {
     //     return new WebMvcRegistrations() {

diff --git a/.../boot-security/src/main/groovy/yakworks/security/spring/DefaultSecurityConfiguration.java b/.../boot-security/src/main/groovy/yakworks/security/spring/DefaultSecurityConfiguration.java
@@ -253,4 +253,10 @@ public OpaqueTokenGenerator opaqueTokenGenerator() {
     public StoreTokenGenerator storeTokenGenerator() {
         return new StoreTokenGenerator();
     }
+
+    @Bean //FIXME should it have @ConditionalOnMissingBean or will that scramble the pick up when spring sec already has one
+    PermissionsAuthorizationManager permissionsAuthorizationManager() {
+        return new PermissionsAuthorizationManager();
+    }
+
 }
diff --git a/...pring/WildcardAuthorizationManager.groovy → ...ng/PermissionsAuthorizationManager.groovy b/...pring/WildcardAuthorizationManager.groovy → ...ng/PermissionsAuthorizationManager.groovy
@@ -8,18 +8,30 @@ import java.util.function.Supplier
 import javax.servlet.http.HttpServletRequest
 
 import org.apache.shiro.authz.permission.WildcardPermission
+import org.springframework.beans.factory.annotation.Value
 import org.springframework.security.authorization.AuthorizationDecision
 import org.springframework.security.authorization.AuthorizationManager
 import org.springframework.security.core.Authentication
 import org.springframework.security.web.access.intercept.RequestAuthorizationContext
 
-class WildcardAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> {
+/**
+ * AuthorizationManager that uses Shiro permissions to check the URL path against Wilcard permissions
+ */
+class PermissionsAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> {
+
+    @Value('${app.security.permissions.enabled:true}')
+    boolean permissionsEnabled
 
     @Override
     AuthorizationDecision check(Supplier<Authentication> authenticationSupplier, RequestAuthorizationContext context) {
         Authentication authentication = authenticationSupplier.get()
         HttpServletRequest request = context.getRequest()
 
+        //if its not enabled then always return true
+        if(!permissionsEnabled){
+            return new AuthorizationDecision(true)
+        }
+
         if (!authentication?.isAuthenticated()) {
             return new AuthorizationDecision(false)
         }

diff --git a/...g/WildcardAuthorizationManagerSpec.groovy → ...ermissionsAuthorizationManagerSpec.groovy b/...g/WildcardAuthorizationManagerSpec.groovy → ...ermissionsAuthorizationManagerSpec.groovy
@@ -5,9 +5,9 @@ import spock.lang.Specification
 
 import javax.servlet.http.HttpServletRequest
 
-class WildcardAuthorizationManagerSpec extends Specification {
+class PermissionsAuthorizationManagerSpec extends Specification {
 
-    WildcardAuthorizationManager manager = new WildcardAuthorizationManager()
+    PermissionsAuthorizationManager manager = new PermissionsAuthorizationManager()
 
     void "test mapToPermission crud"() {
         expect: