Spring Security with controllers - part 2

Turns out applying Spring Security on annotated controllers is working perfectly fine and what's also important, is also happy to work with mixed (old- and new-style) controllers.

First step is to add new controller class that looks like this:

@Controller
@RequestMapping(value = "/s2/*")
public class SimpleController2 {
  
  @Autowired
  private Command command;

  @RequestMapping(method = RequestMethod.GET)
  @Secured("administrator")
  @Permissioned(action = "View", resource = "Video")
  public ModelAndView doSomething2(HttpServletRequest request,
      HttpServletResponse response) {
    System.out.println("Doing something 2");
    command.doSomething();
    return new ModelAndView(new RedirectView(
        "http://www.google.com/search?q=done+something"));

  }
}

Then add the following into Spring context file:

  <context:annotation-config />
  <bean
  class="org.springframework.web.servlet.mvc.annotation.
DefaultAnnotationHandlerMapping" />
  <bean id="simpleController2" class="controllers.SimpleController2" />

And that's it really. URLs with /s1 should go to SimpleController and SimpleController2 will take care about /s2 - important thing is that the security interception will happen already on the controller level which you can easily observe by removing the annotations from commands - you will still get access denied error.