springboot role based access control with both two roles satisfying

Question

I'm implementing a security project using spring boot. I want to allow users with both ADMIN and EXECUTIVE roles to have access to some endpoints. That is, a user must be an ADMIN at the same time EXECUTIVE user for him to access that protected endpoint. How can I achieve this?

Answer 1

You can use expression with logical and - hasRole('ADMIN') and hasRole('EXECUTIVE'). Using the security configuration you can do it like this:

@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
    httpSecurity.authorizeRequests()
            .antMatchers("/your/endpoint").access("hasRole('ADMIN') and hasRole('EXECUTIVE')");
    //other configs
}