如何保护用户角色的Spring控制器方法？

Question

I have USER , ROLE and USER_ROLE tables and a bunch Spring controllers ... is there an Spring annotation I can add to the controller methods that will specify the role(s) a user should have to be able to access it?

I guess it's going to be Spring security? Is that straighforward to wire up to an existing user/role schema?

I'm using Spring 2.5.4.

Answer 1

Spring Security is going to be your easiest way to do it. What you're asking for specifically is Method Security Expressions . You can achieve this by using the following:

@PreAuthorize("hasRole('ROLE_ADMIN')")
public void deleteUser(User user) {
  ...
}

It's pretty straightforward to set up Spring Security with a database backend. I'd take a look at the DAOAuthenticationProvider as a starting point.

Answer 2

Spring Security annotations, as follows:

@Secured({"ROLE_1", "ROLE_2"})
public String mySecuredHander() {
   return "foo";
}