-1

Spring Security has this basic idea of a Principal and GrantedAuthority. I've implemented Spring Security and read this stackoverflow and understand at a basic level that a "ROLE" is nothing more than a GrantedAuthority prefixed with "ROLE_".

What I don't understand is why have this convention in the first place? Why have @PreAuthorize("hasRole('XYZ')") be equivilant to @PreAuthorize("hasAuthority('ROLE_XYZ')")?

What's so special about segregating Granted Authorities like this? What's the purpose?

Additionally, what is the best convention for applying these "ROLES" to specific instances of a Domain Model. Take for example a system that keeps track of projects and you want to explicitly give users access to view and edit certain projects. I could create ROLE_EDIT_PROJECT and ROLE_VIEW_PROJECT but that's application-wide. Where would you make the relationship of a ROLE to a specific project? A join table? Would you even involve Spring Security into this or build this type of security from scratch within your application?

Community
  • 1
  • 1
szxnyc
  • 2,495
  • 5
  • 35
  • 46

1 Answers1

1

I unfortunately don't know why this convention is used, probably just legacy code I would guess.

For the second part of your question, I would suggest using "hasPermission(project, 'view')" and define your own PermissionEvaluator.

more information can be found here

rptmat57
  • 3,643
  • 1
  • 27
  • 38