Is there a way to read Spring Security metadata? - spring-mvc

Question

I am using Spring security and I have a custom Authorization Filter without explicit URL mapping. I have added my Authorization filter after UsernamePasswordAuthenticationFilter.class.
The problem with this approach is, even for the URL patterns which are either permitted or permitted with authentication are going through my Authorization Filter. I do not want to explicitly configure my filter mapping on Authorization Filter since I feel that is redundant(already present in WebSecurityConfigurerAdapter). Is there anyway I can get access to Spring Security metadata or any other way to skip the Authorization Filter for the URLs which are marked as permitAll() or authenticated()?
public class AuthorizationFilter implements Filter {
public void destroy() {
}
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain)
throws IOException, ServletException {
//Calls a webservice to fetch the authorities based on the URL pattern.
//Adds the authentication principal with Authorities to SecurityContextHolder.
}
public void init(FilterConfig config) throws ServletException {
}
}

Answer 1

I have solved this by extending WebExpressionVoter as below:
public class CustomAuthoritiesVoter extends WebExpressionVoter {
private static final String SUPPORTED_CLASS = "org.springframework.security.web.access.expression.WebExpressionConfigAttribute";
#Override
public int vote(Authentication authentication, FilterInvocation fi, Collection<ConfigAttribute> attributes) {
String exp = getExpressionString(attributes);
if (null != exp && !StringUtils.equalsAny(exp, "authenticated", "permitAll")) {
//Call service to fetch the authorities based on the userID and URL
//Set Authentication principal along with fetched Authorities using SecurityContextHolder
}
return super.vote(authentication, fi, attributes);
}
private String getExpressionString(Collection<ConfigAttribute> attributes) {
try {
for (ConfigAttribute attribute : attributes) {
if (attribute.getClass().isAssignableFrom(Class.forName(SUPPORTED_CLASS))) {
return attribute.toString();
}
}
} catch (ClassNotFoundException e) {
log.warn(e.getMessage(), e);
}
return null;
}
}