title: How to evaluate a SpEL Security expression in custom java code?
body: <p>i have come to need to invent a new type of annotations, one of fields of which would be a Spring Expression Language (aka SpEL) expression string.</p>
  
  <p>After a bit googling and examining existing classes, i've figured out that the way of evaluating expression might be like this one (correct me if i am wrong in any way):</p>
  
  <pre><code>    ExpressionParser parser = new SpelExpressionParser();
      Expression exp = parser.parseExpression("isAnonymous()"); // well, this is only an example
      SecurityExpressionRoot context = ... obtaining the instance of subclass of SecurityExpressionRoot ...
      System.out.println(exp.getValue(context)); // just an example
  </code></pre>
  
  <p>But here is the problem: the most suiting for my case MethodSecurityExpressionRoot is package-local. There is even a <a href="https://jira.springsource.org/browse/SEC-2026" rel="noreferrer">task about making it public in Spring Security JIRA</a> which didn't got any attention from developers for a year.</p>
  
  <p>And even if it wasn't package-local, i still have a weak understanding of where to obtain objects for methods <code>setTrustResolver</code>, <code>setRoleHierarchy</code> and <code>setPermissionEvaluator</code> of <code>SecurityExpressionRoot</code> class, which seems to be needed for it's proper functioning.</p>
  
  <p>So, my question is: how do you properly get the correct <code>SecurityExpressionRoot</code>-subclass instance and how to populate it with required objects?</p>