Spring Security roles should always be prefixed with ROLE?

Question

In our application we are using Spring Security and we observed that if the role names are not prefixed with ROLE , it does not work.

Our roles are configured in DB and there is no restriction on the name given to a role.

Is there any work around to avoid the ROLE prefix to roles?

score 1 · Accepted Answer · edited May 23 '17 at 12:19

1

You can find a solution here: Spring Security – adding a custom Role Prefix, according to which you just need to configure the RoleVoter:

<beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
    <beans:property name="rolePrefix" value="" />
</beans:bean>

See also Spring Security Role Prefix and Custom User Details Service.

edited May 23 '17 at 12:19

Community

1
1

answered Dec 26 '13 at 16:03

David Riccitelli

7,491
5
42
56

score 1 · Answer 2 · answered Dec 27 '13 at 07:09

As for me, I haven't noticed this behavior.

In my project I'm using Spring Security 3.1.4.RELEASE with Spring 3.2.3.RELEASE. And my securityContext.xml contains the following lines:

<security:http auto-config="false" use-expressions="true" access-denied-page="/denied.do"
               entry-point-ref="authenticationEntryPoint">
    <security:intercept-url pattern="/index.do" access="hasAnyRole('PROJECT_REVIEW', 'PROJECT_ADMINISTRATOR')"/>
    <!-- Skipped -->
    <security:intercept-url pattern="/**" access="hasAnyRole('PROJECT_REVIEW', 'PROJECT_ADMINISTRATOR')"/>
    <!-- Skipped -->
</security:http>

So, I'm using my custom roles PROJECT_REVIEW, PROJECT_ADMINISTRATOR. And it works fine.

Could you please tell what error do you get?

Spring Security roles should always be prefixed with ROLE?

2 Answers2