Spring Security Role Based Access Authorization Example

Today we will look into spring security role based access and authorization example. However before reading this post, please go through my previous post about “Spring 4 Security MVC Login Logout Example” to get some basic knowledge about Spring 4 Security.

Spring Security Role

In this post, we will discuss how to define, use and manage spring security roles like “USER”, “ADMIN” in Spring Web Application.

Like my previous post, this post example is also using Spring 4 MVC Security with In-Memory Store and Spring Java Configuration Feature to develop the application. That means we are not going to use web.xml file and also not writing even single line of Spring XML Configuration.

We will use “In-Memory Store” option to store and manage User Credentials.

We are going to use Spring 4.0.2.RELEASE, Spring STS 3.7 Suite IDE, Spring TC Server 3.1 with Java 1.8 and Maven build tool to develop this example.

Spring Security Role Based Access Authorization Example

    1. Create a “Simple Spring Web Maven” Project in Spring STS Suite with the following details.

Project Name : SpringMVCSecruityMavenRolesApp

    1. Use same pom.xml file from my previous post with the following changes

    1. Use all Java and JSP files from my previous post. We will discuss only updated or newly added content here.
    2. Update LoginSecurityConfig.java file to configure User roles like “USER” and “ADMIN”.

LoginSecurityConfig.java

Code Explanation

    1. In configureGlobal() method, we have added two users: One user with “ROLE_USER” role and another user with both “ROLE_USER” and “ROLE_ADMIN” roles. That means this second user will act as a Admin User. Like this we can configure any number of users and roles.
    2. We can use either authorities(ROLE) or roles(ROLE) methods to configure Roles in our application.
    3. Difference between authorities() and roles() methods:
  • authorities() needs complete role name like “ROLE_USER”
  • roles() needs role name like “USER”. It will automatically adds “ROLE_” value to this “USER” role name.
  • In configure() method, we have defined different URLs with required Access Roles.

This code snippet configures that “/homePage” is available for both USER and ADMIN Roles.

This code snippet configures that “/userPage” is accessible by “USER” role only and .”/adminPage” is accessible by “ADMIN” role only.

If other roles access these pages, we will get access “403 Access is Denied” Error message.

  • Update LoginController.java Controller file to define new URL access paths as shown below.

LoginController.java

Code Explanation
In addition to the previous post Example, here we have added two more new URLs.

  1. “/userPage” is used by USER Role to access and perform Normal user activities.
  2. “/adminPage” is used by ADMIN Role to access and perform Admin user activities. ADMIN role can access “/userPage” URL too.
  • Updated homePage.jsp file to provide User and Admin Roles specific activities.

homePage.jsp

Here we have add three Menu like options at top frame. “Logout” is already discussed in my previous post.

New two links are:

  1. JD User: Accessible by both “USER” and “ADMIN” Roles
  2. JD Admin: Accessible only by both “ADMIN” Roles

NOTE:- In Real-time applications, we will show only “JD User” link to “USER” Role and hide “JD Admin” link. To test whether it is accessible by “USER” Role or not and also to see the exact error message, we have not hidden this link.

  • Add new adminPage.jsp file to act as a Homepage for “ADMIN” role.

adminPage.jsp

  • Add new userPage.jsp file to act as a Homepage for “USER” role.

userPage.jsp

We have completed our application development now. It’s time to see our project final structure and test the application.

  • Final Project Structure looks like this:
  • springsecruity-roles-example1-295x450

Spring Security Roles Example Application Test

    1. Right Click on Project in Spring STS IDE and select “Run AS >> Run on Server” option.

It will access default Application welcome page as shown below:

springsecruity-roles-example1-295x450

    1. Click on “Login to JournalDEV” link.Now you are at Login Page.
    2. security-login-inmemory-example3-450x231
    1. First login with “USER” Role Credentials:

Username: jduser
Password: jdu@123

security-login-inmemory-example3-450x231

Now we will see Application HomePage with 3 Menu Options: “JD User”, “JD Admin” and “Logout”.

As we have logged in with “USER” Role Credentials, We cannot access this link. That’s why we saw this error message: “403 Access is denied”.

    1. Now Logged and again login with ADMIN Role Credentials

Username: jdadmin
Password: jda@123

This time we can access “JD Admin” Link successfully as shown below.

security-login-inmemory-example3-450x231

Test “Logout” link to Logged out of the Application.

That’s all about Spring security roles example to provide authorised access to web application pages.

By admin

Leave a Reply