Spring Security Access Denied logging with missing

Question

Is there an out of the box solution for a access denied logging in spring security. What I want is basically show which role the user is missing when he gets the access denied exception.

If not, and I have to go down the path of having my own accesssDeniedHandler, how can I access the role configured on that controller which throwed access denied exception.

Thanks!

Answer 1

No, there is no concept of "missing roles" out of the box.

Access denied events are published through Spring's standard event mechanism and you can use an ApplicationListener to subscribe to these, but there is no assumption that an access decision is purely based on roles in Spring Security. To achieve that, you would need to customize the AccessDecisionManager implementation to log information on how it arrived at a particular decision.

The AccessDeniedHandler isn't really relevant in this case.