Implement Role Hierarchy with In-Memory Authentication

In order to configure role hierarchy, you need to

  1. make a bean RoleHierarchy
  2. define a expressionhandler to read role hierarchy
package com.ekiras.ss.config;

import org.springframework.context.annotation.Bean;
import org.springframework.security.access.expression.SecurityExpressionHandler;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;

/**
* @author ekiras
*/

@EnableWebSecurity
public class SpringSecurityConfigurer extends WebSecurityConfigurerAdapter{

private SecurityExpressionHandler<filterinvocation> webExpressionHandler() {
DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy());
return defaultWebSecurityExpressionHandler;
}

@Bean
public RoleHierarchy roleHierarchy(){
RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
roleHierarchy.setHierarchy("ADMIN > USER");
return roleHierarchy;
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("ekansh")
.password("password")
.authorities("USER", "ROLE");
auth.inMemoryAuthentication()
.withUser("admin")
.password("admin")
.authorities("ADMIN");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.expressionHandler(webExpressionHandler())
.antMatchers("/admin/**").hasAuthority("ADMIN")
.antMatchers("/user/**").hasAuthority("USER")
.anyRequest().authenticated()
.and()
.formLogin()
.and()
.logout()
;
}

}

In the example above, we have made a role hierarchy where

  1. ADMIN can access MODERATOR and USER roles,
  2. MODERATOR can access USER roles.
  3. USER can neither access MODERATOR nor ADMIN roles.
    @Bean
public RoleHierarchy roleHierarchy(){
RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
roleHierarchy.setHierarchy("ADMIN > MODERATOR > USER");
return roleHierarchy;
}

This is an easy way to configure and manage roles and role permissions for making security groups.

Also Read


    Download from Github