title: Spring Security - how can I ask invoke access control methods directly?
body: <p>There's a lot of documentation on how to use jsp tags, aop, annotations, the application context, and all of these sorts of things... but how do I access the access control methods directly? What class do I need to create, if any? Is there hidden bean I need to be aware of? It doesn't seem like <code>SecurityContextHolder</code> is the right place to look.</p>
  
  <p>What I'd like to do is something like this:</p>
  
  <pre><code>if(springSecurityObject.isAuthorized("hasAnyRole('DIRECTOR', 'ADMIN')")) {
      // ... do something
  }
  </code></pre>
  
  <p>Or even better:</p>
  
  <pre><code>if(springSecurityObject.hasAnyRole('DIRECTOR', 'ADMIN')) {
      // ... do something
  }
  </code></pre>
  
  <p>Thanks!</p>
  
  <p><strong>EDIT:</strong> It seems like the spring security people are using the granted authorities on the user object itself:</p>
  
  <p><a href="https://fisheye.springsource.org/browse/spring-security/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java?r=fc399af136492c6c37cdddca6d44e5fe57f69680" rel="nofollow">https://fisheye.springsource.org/browse/spring-security/taglibs/src/main/java/org/springframework/security/taglibs/authz/AbstractAuthorizeTag.java?r=fc399af136492c6c37cdddca6d44e5fe57f69680</a></p>
  
  <p>I think it would probably have been helpful if they abstracted out a ton of this code and put it into a nice set of classes instead - something that both the tag libraries and actual users could use. They are private helper methods after all... a common smell that they should probably exist in some classes instead.</p>
  
  <p>Since they are doing the plumbing manually, I guess I have to assume that what I want doesn't exist.</p>