纲要授权流程核心类与投票机制PreInvocationAuthorizationAdviceVoter前置调用授权投票器ExpressionBasedPreInvocationAdvice基于表达式的通知AffirmativeBased一票通过制决策管理器授权检查调用链解析安全表达式提取表达式求值与投票循环日志与结果返回用户组Group扩展思路角色与用户组的本质差异自定义groupCheckerBean在PreAuthorize中组合角色与组校验代码示例用户组权限控制MyUserDetails实体扩展GroupChecker组件UserService方法级安全授权流程源码解析Spring Security 将方法安全注解如PreAuthorize转化为灵活的授权决策其核心是一组基于 AOP 的投票器Voter与通知Advice。理解这一流程有助于排查权限问题并合理扩展。核心类与调用链AffirmativeBased (投票管理器)ExpressionBasedPreInvocationAdvicePreInvocationAuthorizationAdviceVoter代理拦截方法调用AffirmativeBased (投票管理器)ExpressionBasedPreInvocationAdvicePreInvocationAuthorizationAdviceVoter代理拦截方法调用调用受保护方法vote(authentication, methodInvocation)提取 PreAuthorize 注解表达式evaluate(expression, context)解析 SpEL获取 Authenticationallowed true / falsereturn 投票结果 (ACCESS_GRANTED / ACCESS_DENIED)遍历所有 Voter一票赞成即通过授权决策执行目标方法 或 拒绝访问当方法被调用时PreInvocationAuthorizationAdviceVoter首先被触发。它通过vote()方法获取注解中声明的安全表达式如hasRole(ADMIN)随后委托给ExpressionBasedPreInvocationAdvice进行求值。若表达式中包含认证信息或自定义 Bean则结合当前SecurityContext中的Authentication进行判断。最终结果传递给AffirmativeBased决策管理器只要有任何一个 Voter 投赞成票访问即被允许。这一机制保证了权限逻辑的可组合性。下面是一段精简的决策管理器模拟代码用于展示投票循环的本质// 仅示意核心逻辑非框架源码publicclassAffirmativeBasedDecisionManager{privateListAccessDecisionVotervoters;publicvoiddecide(Authenticationauthentication,Objectobject){for(AccessDecisionVotervoter:voters){intresultvoter.vote(authentication,object);if(resultAccessDecisionVoter.ACCESS_GRANTED){// 一票通过记录日志并返回logger.info(Voter voter returned ACCESS_GRANTED);return;}}thrownewAccessDeniedException(拒绝访问);}}用户组扩展思路在实际项目中常常需要“部门”、“组织”或“用户组”的概念。角色Role是权限的集合而用户组本质上是用户的集合——将一批用户归入同一组再给组赋权。Spring Security 虽然提供了基于 Group 的复杂模型但在多数场景下并不必要。更轻量的做法是直接利用方法安全表达式嵌入自定义检查。设计方案在UserDetails实现中增加group字段存放当前用户所属的组标识如部门 ID。编写一个 Spring Bean注入到 SpEL 上下文中提供checkGroup(Authentication, String)方法。在PreAuthorize中组合角色判断与组判断例如PreAuthorize(hasRole(ROLE_DEPT_ADMIN) and groupChecker.checkGroup(authentication, #group))这样即可限制用户只能操作自己所在组的资源而无需引入额外的安全模块。完整可运行代码示例以下代码展示如何实现基于用户组的资源访问控制。所有类均包含必要注解可直接集成到 Spring Boot 项目中。// MyUserDetails.javapackagecom.example.security;importorg.springframework.security.core.GrantedAuthority;importorg.springframework.security.core.userdetails.UserDetails;importjava.util.Collection;publicclassMyUserDetailsimplementsUserDetails{privateStringusername;privateStringpassword;privateStringgroup;// 用户组标识如部门IDprivateCollection?extendsGrantedAuthorityauthorities;publicMyUserDetails(Stringusername,Stringpassword,Stringgroup,Collection?extendsGrantedAuthorityauthorities){this.usernameusername;this.passwordpassword;this.groupgroup;this.authoritiesauthorities;}publicStringgetGroup(){returngroup;}OverridepublicCollection?extendsGrantedAuthoritygetAuthorities(){returnauthorities;}OverridepublicStringgetPassword(){returnpassword;}OverridepublicStringgetUsername(){returnusername;}OverridepublicbooleanisAccountNonExpired(){returntrue;}OverridepublicbooleanisAccountNonLocked(){returntrue;}OverridepublicbooleanisCredentialsNonExpired(){returntrue;}OverridepublicbooleanisEnabled(){returntrue;}}// GroupChecker.javapackagecom.example.security;importorg.springframework.security.core.Authentication;importorg.springframework.stereotype.Component;Component(groupChecker)publicclassGroupChecker{/** * 检查当前认证用户的 group 是否与目标组一致 */publicbooleancheckGroup(Authenticationauthentication,StringtargetGroup){if(authenticationnull||targetGroupnull){returnfalse;}Objectprincipalauthentication.getPrincipal();if(principalinstanceofMyUserDetails){MyUserDetailsuser(MyUserDetails)principal;returntargetGroup.equals(user.getGroup());}returnfalse;}}// ResourceService.javapackagecom.example.service;importcom.example.domain.Resource;importorg.springframework.security.access.prepost.PreAuthorize;importorg.springframework.stereotype.Service;importjava.util.List;ServicepublicclassResourceService{/** * 只有管理员角色并且请求组与用户组一致时才能访问 */PreAuthorize(hasRole(ROLE_DEPT_ADMIN) and groupChecker.checkGroup(authentication, #group))publicListResourcegetResourcesByGroup(Stringgroup){// 模拟数据库查询returnList.of(newResource(group,confidential-data));}}// Resource.java (简单领域对象)packagecom.example.domain;publicclassResource{privateStringgroup;privateStringdata;publicResource(Stringgroup,Stringdata){this.groupgroup;this.datadata;}// getters setters ...}项目目录结构如下src/main/java/com/example/ ├── security │ ├── MyUserDetails.java │ └── GroupChecker.java ├── service │ └── ResourceService.java └── domain └── Resource.javaAPI 速览组件作用PreInvocationAuthorizationAdviceVoter将PreAuthorize注解转换为投票对象ExpressionBasedPreInvocationAdvice对 SpEL 表达式进行求值AffirmativeBased一票即过的投票策略PreAuthorize声明方法前置安全表达式groupChecker(自定义)扩展 SpEL 上下文实现组级权限官方文档Spring Security Method SecuritySpring Security Architecture总结本文从 Spring Security 授权表决流程的源码切入剖析了PreInvocationAuthorizationAdviceVoter与AffirmativeBased的协作方式并在此基础上给出了一种轻量级的用户组权限扩展方案——通过自定义Bean与PreAuthorize结合实现部门级资源隔离。这一思路在 OAuth2 资源服务器环境中同样适用因为方法级安全与认证协议无关只要Authentication中包含足够的信息即可。建议在实际项目中先用最简模型满足需求再逐步迭代。