javaauthenticationsecurityplayframeworkpac4j

pac4j configure authorizers with OR

I am using DirectBearerAuthClient with Authorizes. According to the pac4j default behavior if multiple authorizes aredefined , then all should be stisfied, lets take below example, there are two authorizes and a URL

Authorizer : allowRead, allowRight URL: /student/action

#Config Ex1:

pac4j.security.rules = [
{
    "/student/action" = {
      authorizers = "allowRead,AllowRight"
      clients = "DirectBearerAuthClient"
    }
}

]

#Config Ex2:

pac4j.security.rules = [
{
    "/student/action" = {
      authorizers = "allowRead"
      clients = "DirectBearerAuthClient"
    }
}

]

Ex1 : both Authorizes should be statisifed "allowRead,AllowRight" to access the URL, so both should be satisfied

Ex2 : only one authorized "allowRead" should be satisfied to access the URL, if user have "allowWrite" instead of "allowReady" then not to access URL

is it possible to configure Authorize as with 'OR' condition , like authorizers = "allowRead OR AllowRight", which mean any user has one to these two authorizes can access the URL , for example to configure something like

pac4j.security.rules = [
{
    "/student/action" = {
      authorizers = "allowRead OR AllowRight"
      clients = "DirectBearerAuthClient"
    }
}

]
Solution

  • The authorizers listed in the authorizers parameter must be all satisfied, meaning they are treated as "AND".

    If you want to implement the "OR" logic, you must define a specific authorizer based on the OrAuthorizer. Example:

    final Config c = new Config(clients);
c.addAuthorizer("orAuthorizer",
  OrAuthorizer.or(
    new RequireAnyRoleAuthorizer("allowRead"),
    new RequireAnyRoleAuthorizer("AllowRight")
  )
);
return c;