diff --git a/docs/manual/src/docbook/authorization-common.xml b/docs/manual/src/docbook/authorization-common.xml
index 891aa9cbea..60b327eebb 100644
--- a/docs/manual/src/docbook/authorization-common.xml
+++ b/docs/manual/src/docbook/authorization-common.xml
@@ -65,7 +65,7 @@
methods:
void decide(Authentication authentication, Object secureObject,
- List<ConfigAttribute> config) throws AccessDeniedException;
+ Collection<ConfigAttribute> attrs) throws AccessDeniedException;
boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz);
@@ -113,7 +113,7 @@
The AccessDecisionVoter interface has three
methods:
-int vote(Authentication authentication, Object object, List<ConfigAttribute> config);
+int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attrs);
boolean supports(ConfigAttribute attribute);
boolean supports(Class clazz);
@@ -173,24 +173,18 @@ boolean supports(Class clazz);
AuthenticatedVoter. See the Javadoc for this class for
more information.
-
+ Custom Voters
- It is also possible to implement a custom
- AccessDecisionVoter. Several examples are
- provided in Spring Security unit tests, including
- ContactSecurityVoter and DenyVoter. The
- ContactSecurityVoter abstains from voting decisions where a
- CONTACT_OWNED_BY_CURRENT_USER
- ConfigAttribute is not found. If voting, it queries the
- MethodInvocation to extract the owner of the
- Contact object that is subject of the method call. It votes
- to grant access if the Contact owner matches the principal
- presented in the Authentication object. It could
- have just as easily compared the Contact owner with some
- GrantedAuthority the
- Authentication object presented. All of this is
- achieved with relatively few lines of code and demonstrates the flexibility of
- the authorization model.
+ Obviously, you can also implement a custom
+ AccessDecisionVoter and you can
+ put just about any access-control logic you want in it. It might
+ be specific to your application (business-logic related) or it
+ might implement some security administration logic. For example, you'll find
+ a
+ blog article on the SpringSource web site which describes how to
+ use a voter to deny access in real-time to users whose accounts have
+ been suspended.
+