Spring Security Role Based Access Authorization Example

Filed Under: Spring

Today we will look into spring security role based access and authorization example. However before reading this post, please go through my previous post about “Spring 4 Security MVC Login Logout Example” to get some basic knowledge about Spring 4 Security.

Spring Security Role

In this post, we will discuss how to define, use and manage spring security roles like “USER”, “ADMIN” in Spring Web Application.

Like my previous post, this post example is also using Spring 4 MVC Security with In-Memory Store and Spring Java Configuration Feature to develop the application. That means we are not going to use web.xml file and also not writing even single line of Spring XML Configuration.

We will use “In-Memory Store” option to store and manage User Credentials.

We are going to use Spring 4.0.2.RELEASE, Spring STS 3.7 Suite IDE, Spring TC Server 3.1 with Java 1.8 and Maven build tool to develop this example.

Spring Security Role Based Access Authorization Example

  1. Create a “Simple Spring Web Maven” Project in Spring STS Suite with the following details.
  2. Project Name : SpringMVCSecruityMavenRolesApp

  3. Use same pom.xml file from my previous post with the following changes
  4. 
    <artifactId>SpringMVCSecruityMavenRolesApp</artifactId>
    
    <build>
      <finalName>SpringMVCSecruityMavenRolesApp</finalName>
    </build>
    </project>
    
  5. Use all Java and JSP files from my previous post. We will discuss only updated or newly added content here.
  6. Update LoginSecurityConfig.java file to configure User roles like “USER” and “ADMIN”.
  7. LoginSecurityConfig.java

    
    package com.journaldev.spring.secuity.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    
    @Configuration
    @EnableWebSecurity
    public class LoginSecurityConfig extends WebSecurityConfigurerAdapter {
    
    	@Autowired
    	public void configureGlobal(AuthenticationManagerBuilder authenticationMgr) throws Exception {
    		authenticationMgr.inMemoryAuthentication()
    			.withUser("jduser").password("jdu@123").authorities("ROLE_USER")
    			.and()
    			.withUser("jdadmin").password("jda@123").authorities("ROLE_USER","ROLE_ADMIN");
    	}
    	
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    
    		
    		http.authorizeRequests()
    			.antMatchers("/homePage").access("hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')")
    			.antMatchers("/userPage").access("hasRole('ROLE_USER')")
    			.antMatchers("/adminPage").access("hasRole('ROLE_ADMIN')")
    			.and()
    				.formLogin().loginPage("/loginPage")
    				.defaultSuccessUrl("/homePage")
    				.failureUrl("/loginPage?error")
    				.usernameParameter("username").passwordParameter("password")				
    			.and()
    				.logout().logoutSuccessUrl("/loginPage?logout"); 
    		
    	}
    }
    

    Code Explanation

    1. In configureGlobal() method, we have added two users: One user with “ROLE_USER” role and another user with both “ROLE_USER” and “ROLE_ADMIN” roles. That means this second user will act as a Admin User. Like this we can configure any number of users and roles.
    2. We can use either authorities(ROLE) or roles(ROLE) methods to configure Roles in our application.
    3. Difference between authorities() and roles() methods:
      • authorities() needs complete role name like “ROLE_USER”
      • roles() needs role name like “USER”. It will automatically adds “ROLE_” value to this “USER” role name.
    4. In configure() method, we have defined different URLs with required Access Roles.
    5. 
      antMatchers("/homePage")
         .access("hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')")
      

      This code snippet configures that “/homePage” is available for both USER and ADMIN Roles.

      
       .antMatchers("/userPage").access("hasRole('ROLE_USER')")
       .antMatchers("/adminPage").access("hasRole('ROLE_ADMIN')")
      

      This code snippet configures that “/userPage” is accessible by “USER” role only and .”/adminPage” is accessible by “ADMIN” role only.

      If other roles access these pages, we will get access “403 Access is Denied” Error message.

  8. Update LoginController.java Controller file to define new URL access paths as shown below.
  9. LoginController.java

    
    package com.journaldev.spring.web.controller;
    
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.bind.annotation.RequestParam;
    import org.springframework.web.servlet.ModelAndView;
    
    @Controller
    public class LoginController {
    
    	@RequestMapping(value = { "/"}, method = RequestMethod.GET)
    	public ModelAndView welcomePage() {
    		ModelAndView model = new ModelAndView();
    		model.setViewName("welcomePage");
    		return model;
    	}
    
    	@RequestMapping(value = { "/homePage"}, method = RequestMethod.GET)
    	public ModelAndView homePage() {
    		ModelAndView model = new ModelAndView();
    		model.setViewName("homePage");
    		return model;
    	}
    	
    	@RequestMapping(value = {"/userPage"}, method = RequestMethod.GET)
    	public ModelAndView userPage() {
    		ModelAndView model = new ModelAndView();
    		model.setViewName("userPage");
    		return model;
    	}
    	
    	@RequestMapping(value = {"/adminPage"}, method = RequestMethod.GET)
    	public ModelAndView adminPage() {
    		ModelAndView model = new ModelAndView();
    		model.setViewName("adminPage");
    		return model;
    	}
    	
    	@RequestMapping(value = "/loginPage", method = RequestMethod.GET)
    	public ModelAndView loginPage(@RequestParam(value = "error",required = false) String error,
    	@RequestParam(value = "logout",	required = false) String logout) {
    		
    		ModelAndView model = new ModelAndView();
    		if (error != null) {
    			model.addObject("error", "Invalid Credentials provided.");
    		}
    
    		if (logout != null) {
    			model.addObject("message", "Logged out from JournalDEV successfully.");
    		}
    
    		model.setViewName("loginPage");
    		return model;
    	}
    
    }
    

    Code Explanation
    In addition to the previous post Example, here we have added two more new URLs.

    1. “/userPage” is used by USER Role to access and perform Normal user activities.
    2. “/adminPage” is used by ADMIN Role to access and perform Admin user activities. ADMIN role can access “/userPage” URL too.
  10. Updated homePage.jsp file to provide User and Admin Roles specific activities.
  11. homePage.jsp

    
    <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
    <a href="${pageContext.request.contextPath}/userPage">JD User</a> | <a href="${pageContext.request.contextPath}/adminPage">JD Admin</a> | <a href="javascript:document.getElementById('logout').submit()">Logout</a>
    
    <h3>Welcome to JournalDEV Tutorials</h3>
    <ul>
       <li>Java 8 tutorial</li>
       <li>Spring tutorial</li>
       <li>Gradle tutorial</li>
       <li>BigData tutorial</li>
    </ul>
    
    <c:url value="/logout" var="logoutUrl" />
    <form id="logout" action="${logoutUrl}" method="post" >
      <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    </form>
    

    Here we have add three Menu like options at top frame. “Logout” is already discussed in my previous post.

    New two links are:

    1. JD User: Accessible by both “USER” and “ADMIN” Roles
    2. JD Admin: Accessible only by both “ADMIN” Roles

    NOTE:- In Real-time applications, we will show only “JD User” link to “USER” Role and hide “JD Admin” link. To test whether it is accessible by “USER” Role or not and also to see the exact error message, we have not hidden this link.

  12. Add new adminPage.jsp file to act as a Homepage for “ADMIN” role.
  13. adminPage.jsp

    
    <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
    <h3>Welcome to JournalDEV Tutorials</h3>
    <h3>Admin Page</h3>
    
    <c:url value="/logout" var="logoutUrl" />
    <form id="logout" action="${logoutUrl}" method="post" >
      <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    </form>
    <c:if test="${pageContext.request.userPrincipal.name != null}">
    	<a href="javascript:document.getElementById('logout').submit()">Logout</a>
    </c:if>
    
  14. Add new userPage.jsp file to act as a Homepage for “USER” role.
  15. userPage.jsp

    
    <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
    <h3>Welcome to JournalDEV Tutorials</h3>
    <h3>User Page</h3>
    
    <c:url value="/logout" var="logoutUrl" />
    <form id="logout" action="${logoutUrl}" method="post" >
      <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    </form>
    <c:if test="${pageContext.request.userPrincipal.name != null}">
    	<a href="javascript:document.getElementById('logout').submit()">Logout</a>
    </c:if>
    

    We have completed our application development now. It’s time to see our project final structure and test the application.

  16. Final Project Structure looks like this:
  17. spring security roles example

Spring Security Roles Example Application Test

  1. Right Click on Project in Spring STS IDE and select “Run AS >> Run on Server” option.
  2. It will access default Application welcome page as shown below:

    security security  role login inmemory example

  3. Click on “Login to JournalDEV” link.Now you are at Login Page.
  4. Spring Security Role Based Access Authorization Example

  5. First login with “USER” Role Credentials:
  6. Username: jduser
    Password: jdu@123

    Spring Security Role

    Now we will see Application HomePage with 3 Menu Options: “JD User”, “JD Admin” and “Logout”.

    Click on “JD User” link. As we have logged into application using “USER” Role Credentials, We can access this link as shown below.

    Spring Security Role Based Access

    Just use backword arrow in Spring STS IDE and this time click on “JD Admin” Link.

    Spring Security Roles

    As we have logged in with “USER” Role Credentials, We cannot access this link. That’s why we saw this error message: “403 Access is denied”.

  7. Now Logged and again login with ADMIN Role Credentials
  8. Username: jdadmin
    Password: jda@123

    This time we can access “JD Admin” Link successfully as shown below.

    Spring Security Roles Example

    Test “Logout” link to Logged out of the Application.

That’s all about Spring security roles example to provide authorised access to web application pages.

Comments

  1. Malav Jani says:

    Please give me source code of the lOGIN page.
    I am not getting that from where .antMatcher can get “/homePage” when clicked on “Login” Button

    1. Deepak says:

      Hi, This code is not working on eclipse.

  2. Heyraf says:

    That’s good. thanks bro

  3. Tomeshwar says:

    please provide source code.

  4. Ranveer says:

    All these authorization are static, can be changed. Like if I want to add a new role as “BOSS”, I have to make changes in code and deploy again. Is there any way to read details from the Database.

  5. Naguru says:

    where is source code sir

  6. rajeev says:

    name=”${_csrf.parameterName}” value=”${_csrf.token}

    is not necessary if you are using Spring tag libs. Specifically spring tag lib for form

    Then the
    tag changes to

  7. Krish says:

    Can we have a session management according to the user roles

  8. Kunal says:

    Hi! Suppose the link that the admin can access needs to display all the users with USER role, how would you get the list of user from in memory authentication? I’m trying to achieve this in my app. Any help will be much appreciated

  9. sdfs says:

    Hi, Great airticle.

  10. Rohit says:

    Hi,
    what i am doing is i have a user who has many roles some of which are ROLE_ADMIN and ROLE_DBA.
    in spring-security xml i have configured intercept url like

    when I log in i can access url /admin/** but I cant access url /dba/** even i have ROLE_DBA in list of GrantedAuthoriy while creating UserDetail object in UserDetailService.

    Thank you

  11. Bhanu Dhulipudi says:

    Hi,

    Thanks for this tutorial. Good explanation.

    If possible, can you please develop and deliver a Spring Security + LDAP + SSO + Tomcat 8 example at the earliest.

  12. marc says:

    hi

    how to allow role_user to some get url….

    and

    some all (get, post, put, delete) to admin role

  13. me says:

    It would be nice if you would use real code instead of the " everwhere.

  14. Arny says:

    Nice work, it is a good starter for Spring-Security module. I wanted to try it myself so I prepared my own project on github (https://github.com/arnosthavelka/security-poc/tree/spring-boot-%26-in-memory-security).

    I made several improvements & changes:
    * @Import is not necessary
    * Controller is reduced just for /login (the rest is moved to MVC config since it is just mapping)
    * optimized security settings
    * internationalization
    * changed to Spring Boot (the worst problem :-))

    My project is heavily based on your sources, but it is available complete.

    1. Rambabu says:

      Thanks Arny. I’m delivering a Complete Spring Boot Tutorial along with Spring Security and Gradle tutorials. I have already delivered Spring Boot Basic tutorials. My next plan is to deliver this kind of Spring Boot Security example. Then finally I will deliver full-fledged Spring Boot Security SSO Gradle Application.

Leave a Reply

Your email address will not be published. Required fields are marked *

close
Generic selectors
Exact matches only
Search in title
Search in content
Search in posts
Search in pages