Annotation Interface Authorized

@Retention(RUNTIME) @Target({METHOD,TYPE,FIELD}) @Documented @Inherited public @interface Authorized
An annotation used to specify server resources with enforced authorization.

The following sample shows examples of use of @Authorized annotation on application endpoints: 

 @Authorized
 @Authenticated
 public class SecuredEndpoint { ... }

 @Authorized(false)
 public class PublicEndpoint {
   public String getResourceContent() { ... }

   // Only authenticated users can update the content of the public resource
   @Authorized
   public String setNewResourceContent(String content) { ... }
 }

Authorized annotation is not cumulative - e.g. if you define this annotation on a resource method, it will take ALL values from this instance of Authorized (so if you want to use a custom authorization provider, you must define it again in each Authorized instance).

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final TypeName
    TYPE
    Type name of this annotation.

  • Optional Element Summary

    Optional Elements
    Modifier and Type
    Optional Element
    Description
    boolean
    explicit
    By default, authorization is implicit and all annotations are processed before method invocation to authorize access.
    String
    provider
    Explicit authorization provider to use when processing this Authorized.
    boolean
    value
    Determine whether authorization should be enabled.

  • Field Details

    • TYPE

      static final TypeName TYPE
      Type name of this annotation.

  • Element Details

    • value

      boolean value
      Determine whether authorization should be enabled. Defaults to true
      Returns:
      true if authorization should be enabled.
      Default:
      true

    • provider

      String provider
      Explicit authorization provider to use when processing this Authorized. Setting this value will ignore security provider configured globally. Value is the name of a configured AuthenticationProvider.
      Returns:
      name of a configured provider
      Default:
      ""

    • explicit

      boolean explicit
      By default, authorization is implicit and all annotations are processed before method invocation to authorize access. In case this is set to true, authorization MUST be invoked manually, calling SecurityContext.authorize(Object...). If set to true the security module will not check authorization; security module still checks that authorization was called. If not, an exception is generated post-processing. For example the Jersey integration will return an internal server error in such a case.
      Returns:
      true if explicit authorization will be invoked in the code, false for implicit (handled by security module)
      Default:
      false