How to use role-hierarchy in Spring Security 3 with Spring EL?

Posted by Aleksey on Stack Overflow See other posts from Stack Overflow or by Aleksey
Published on 2010-03-25T13:18:52Z Indexed on 2010/03/25 14:03 UTC
Read the original article Hit count: 608

Filed under:

spring-security

|

roles

|

spring

I want to use @PreAuthorize annotation on service methods with Spring Security. One of requirements is to use role-hierarchy. But by default it is not enabled.

I found that in SecurityExpressionRoot class ("the base class for expression root objects") there is a property roleHierarchy. The class actually does use this property for methods like hasRole() and hasAnyRole().

I suppose that if I supply it with my own RoleHierarchy bean I will be able to use @PreAuthorize annotations with hierarchical roles.

How can I inject my hierarchy bean into SecurityExpressionRoot?

© Stack Overflow or respective owner

Related posts about spring-security

Spring Security - Interactive login attempt was unsuccessful

as seen on Stack Overflow - Search for 'Stack Overflow'
I've been trying to track down why Spring Security isn't creating the SPRING_SECURITY_REMEMBER_ME_COOKIE so I turned on logging for org.springframework.security.web.authentication.rememberme. At first glance, the logs make it seem like the login is failing but the login is actually successful in the… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More
Spring Security - Persistent Remember Me Issue

as seen on Stack Overflow - Search for 'Stack Overflow'
I've been trying to track down why Spring Security isn't creating the Spring Security remember me cookie (SPRING_SECURITY_REMEMBER_ME_COOKIE). At first glance, the logs make it seem like the login is failing, but the login is actually successful in the sense that if I navigate to a page that requires… >>> More
Problem with Remember Me Service in Spring Security

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I'm trying to implement a "remember me" functionality in my website using Spring. The cookie and entry in the persistent_logins table are getting created correctly. Additionally, I can see that the correct user is being restored as the username is displayed at the top of the page. However, once… >>> More
Spring Security 3 - j_spring_security_check is not found

as seen on Stack Overflow - Search for 'Stack Overflow'
I use Spring Security with Spring Framework 3 and when I tyr to login from homepage I get following error: 2010-04-26 12:16:39,525 [tomcat-http--2] WARN org.springframework.web.servlet.PageNotFound - No mapping found for HTTP request with URI [/AppName/app/j_spring_security_check] in DispatcherServlet… >>> More

Related posts about roles

devise roles: different roles, in some cases same rights

as seen on Stack Overflow - Search for 'Stack Overflow'
I have two roles in devise. The first is the admin and the second the normal user-role. Now I´d like to give these two groups in some cases same rights with before filters. How does this work? I have: before_filter :authenticate_user!, :only = [:new, :create] before_filter :authenticate_admin!,… >>> More
ACL actions tag cause 'roles resource tree' draw incorrectly in admin/system/permissions/roles

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, We created new action similar to 'hold', 'ship' and others in the 'sales_order/view' admin section that can be triggered by clicking at the button. Afterward, we added our new action to the ACL with the following code in config.xml: <acl> <resources> <admin>… >>> More
Explicit GRANTs and ROLES in Oracle Database 11g

as seen on Internet.com - Search for 'Internet.com'
Many database shops have no idea of the security breaches that occur across user granted privilege and floating unused synonyms. James Koopmann offers tips for granting privileges explicitly to a user or group of users, and assigning privileges to a role and then granting that role to users. >>> More
How to Structure Leadership Roles for Guaranteed Project Delivery

as seen on Internet.com - Search for 'Internet.com'
Building partnerships between management and architecture can help augment the project manager's role and guarantee delivery. >>> More
Security in OBIEE 11g, Part 2

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Continuing the series on OBIEE 11g, our guest blogger this week is Pravin Janardanam. Here is Part 2 of his overview of Security in OBIEE 11g. OBIEE 11g Security Overview, Part 2 by Pravin Janardanam In my previous blog on Security, I discussed the OBIEE 11g changes regarding Authentication mechanism… >>> More