Add AuthorizationManagerFactory

[sjohnr]

This PR is a work in progress. cc: @rwinch

[rwinch]

Thanks for the updates @sjohnr! I've provided feedback inline.

[rwinch]

remove the defaultAuthorizationManagerFactory in favor of a method named getDefaultAuthorizationManagerFactory() that:

• is deprecated for removal in 8.0 in favor of getAuthorizationManagerFactory(). Any methods that need to access it to perform setters should be deprecated in favor of setting an already initialized (properties already set) AuthorizationManagerFactory directly vs accessing the properties on the current member.
• Throws an IllegalStateException if authorizationManagerFactory is not an instance of DefaultAuthorizationManagerFactory, but otherwise performs a cast. This ensures that the AuthorizationManagerFactory being used aligns with what is being configured or gotten.

[rwinch]

Same feedback as the comment on AbstractSecurityExpressionHandler.defaultAuthorizationManagerFactory.

[rwinch]

DEFAULT_AUTHORIZATION_MANAGER_FACTORY should also be removed in favor of just using authorizationManagerFactory. as described below.

[rwinch]

Suggested change

	public abstract class SecurityExpressionRoot<T> implements SecurityExpressionOperations {
	public abstract class SecurityExpressionRoot<T extends @Nullable Object> implements SecurityExpressionOperations {

I think this is necessary for the generic to allow for a Nullable generic (e.g. MyExpressionRoot <@Nullable SomeType>)

[rwinch]

Suggested change

	public final class DefaultAuthorizationManagerFactory<T> implements AuthorizationManagerFactory<T> {
	public final class DefaultAuthorizationManagerFactory<T extends @Nullable Object> implements AuthorizationManagerFactory<T> {

[rwinch]

Suggested change

	public MessageSecurityExpressionRoot(Supplier<Authentication> authentication, Message<?> message) {
	public MessageSecurityExpressionRoot(Supplier<Authentication> authentication, Message<T> message) {

[rwinch]

Suggested change

	public final Message<?> message;
	public final Message<T> message;

[rwinch]

Suggested change

	// Since MessageSecurityExpressionRoot is of a different type, use the default
	// factory instead of the one configured with this class.
	root.setTrustResolver(getDefaultAuthorizationManagerFactory().getTrustResolver());
	root.setRoleHierarchy(getDefaultAuthorizationManagerFactory().getRoleHierarchy());
	root.setAuthorizationManagerFactory(getAuthorizationManagerFactory());

If a custom authorizationManagerFactory is used, this does not use it. I've fixed the generic types so that they align

[rwinch]

Suggested change

	// Since WebSecurityExpressionRoot is of a different type, use the default factory
	// instead of the one configured with this class.
	root.setTrustResolver(getDefaultAuthorizationManagerFactory().getTrustResolver());
	root.setRoleHierarchy(getDefaultAuthorizationManagerFactory().getRoleHierarchy());
	root.setDefaultRolePrefix(getDefaultAuthorizationManagerFactory().getRolePrefix());
	return root;
	}
	root.setAuthorizationManagerFactory(getAuthorizationManagerFactory());
	return root;
	}
	@Deprecated(forRemoval = true, since = "7.0")
	protected SecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication,
	FilterInvocation fi) {
	RequestAuthorizationContext authorizationContext = new RequestAuthorizationContext(
	fi.getRequest());
	return createSecurityExpressionRoot(authentication, authorizationContext);
	}

[rwinch]

This is a similar problem to the comment for DefaultMessageSecurityExpressionHandler.

To solve it, we should create a package scoped FilterInvocationContextRoot that has a public final HttpServletRequest request member and extends SecurityExpressionRoot<FilterInvocation>. This method would then use FilterInvocationContextRoot instead of WebSecurityExpressionRoot.

Then, we should create a ticket to consider deprecating the authorization logic that depends on FilterInvocation (e.g. the SecurityExressionHandler and FilterInvocationContextRoot)