AuthorizationManager

AuthorizationManager is a Spring Security abstraction that decides whether a request, method invocation, or other secured operation should be allowed for the current authenticated principal. It centralizes authorization logic behind a common interface that evaluates access against a specific context.

AuthorizationManager is a core authorization abstraction in Spring Security. Its responsibility is to determine whether an authenticated user is allowed to perform a particular action in a given context.

The interface is generic, commonly represented as `AuthorizationManager<T>`, where `T` describes the secured object being evaluated. Different implementations can authorize web requests, method calls, messages, or custom application resources.

Instead of embedding access checks throughout business code, authorization rules can be expressed through AuthorizationManager implementations. This improves consistency and makes security policies easier to test and maintain.

During request processing, Spring Security supplies authentication information and the relevant context to the manager. The manager evaluates the rule set and returns an authorization decision that indicates whether access should be granted.

AuthorizationManager is focused on authorization, not authentication. Authentication establishes identity, while AuthorizationManager determines what that identity is permitted to do.

Key points

• Evaluates whether an authenticated principal may perform an action
• Uses the generic form `AuthorizationManager<T>` to support different secured contexts
• Separates authorization rules from business logic
• Can be used for web, method, messaging, or custom authorization scenarios
• Operates after authentication has established identity

Interview questions

What is the purpose of AuthorizationManager in Spring Security?

AuthorizationManager determines whether an authenticated principal can access a protected resource or perform a protected action. It receives authorization context and evaluates rules against the current authentication. The result is an authorization decision that allows or denies access. Its main goal is to provide a consistent authorization mechanism across different security scenarios.

Why is AuthorizationManager generic with the type parameter `T`?

The generic parameter allows the same authorization abstraction to work with different secured object types. A web request, method invocation, or message can each provide different context data. By parameterizing the context type, implementations can evaluate rules using information specific to that scenario while keeping a common authorization contract.

How would you explain the difference between AuthenticationManager and AuthorizationManager?

AuthenticationManager establishes who the user is by validating credentials or another authentication mechanism. AuthorizationManager assumes an identity already exists and decides whether that identity has permission to perform an action. Authentication answers 'who are you', while authorization answers 'what are you allowed to do'. Both are important but solve different security problems.

What benefits come from moving authorization logic into AuthorizationManager implementations?

Centralizing authorization logic improves maintainability, consistency, and testability. Security policies are defined in dedicated components instead of being scattered throughout services and controllers. This reduces duplication and makes policy changes easier. It also allows authorization rules to be reused across multiple entry points in the application.

When would you create a custom AuthorizationManager?

A custom AuthorizationManager is useful when access decisions depend on application-specific rules that are not covered by built-in mechanisms. Examples include resource ownership checks, tenant-aware authorization, or complex business constraints. The custom implementation can inspect authentication details and contextual information to make a decision. This keeps specialized authorization logic in a dedicated security component.