How to check level level of spring method

Question

I implemented spring security in a controller method.

Below is my spring security.xml

->

<!-- URL pattern based security --> <security:http auto-config="false" entry-point-ref="authenticationEntryPoint" use-expressions="true"> <custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" /> <security:intercept-url access="hasAnyRole('ROLE_ADMIN','ROLE_USER')" pattern="/common/admin/**" /> <security:intercept-url pattern="/common/accounting/**" access="hasRole('ROLE_USER')" /> <security:logout logout-url="/j_spring_security_logout" invalidate-session="true" logout-success-url="/login"/> </security:http> 

Below is my controller

 @Secured({"ROLE_ADMIN"}) @RequestMapping(value = "/common/admin/addAdmin", method = RequestMethod.GET) public String add(ModelMap map) { map.addAttribute(new Administrator()); return "/common/admin/addAdmin"; } @Secured({"ROLE_ADMIN"}) @RequestMapping(value = "/common/admin/addAdmin", method = RequestMethod.POST) public String processadd( @ModelAttribute("administrator") Administrator administrator) { this.administratorManager.addAdmin(administrator); return "/common/admin/success"; } 

I allow url / common / admin / ** for the admin and user roles. But I make some restrictions in the admin controller. when a user logs into / common / admin / * as a user role, he can, but he can also enter a method that is only for the administrator role.

How can I solve it?

Thanks!

Answer 1

You have already added the @Secured annotation.

But you need to enable it:

 <!-- secured-annotations = (@Secured("ROLE_ADMIN")) --> <!-- jsr250-annotations = (@RunAs @RolesAllowed @PermitAll @DenyAll @DeclareRoles) --> <!-- pre-post-annotations = @PreAuthorized("hasAuthority('ROLE_ADMIN')") --> <global-method-security secured-annotations="enabled" jsr250-annotations="disabled" pre-post-annotations="disabled"> </global-method-security> 

@Secured can take one or more roles.

• @Secured("ROLE_USER")
• @Secured({"ROLE_USER", "ROLE_ADMIN"}) // large access if the user has one of these roles

BWT: From Spring Security 3 Book (http://www.springsecuritybook.com/):

@Secured is a function of allz and syntactiallz, the same as @RollesAllowed ... Since @Secured functions the same as JSR @RollesAllowed standard, there is no convincing reason for using it ( @Secured ) in the new code ...

(don't forget to enable it jsr250-annotations="enabled" )

Answer 2

I believe that you can have several roles defined using the @Secured annotation. That's what you need?

If so, try @RolesAllowed

Answer 3

Check this FAQ . Make sure the global-method-security element is in the web context file if you want to apply security to Spring MVC controllers.

In addition, you may need to enable class proxies using

 <global-method-security secured-annotations="enabled" proxy-target-class="true" /> 

if your controller implements an interface, and the method you protect is not part of this interface (for this you will also need cglib as an additional dependency in your application).

Answer 4

If you want to use annotations, it is better to put the following in the servlet.xml file. It makes no sense to include n spring-security-xml annotations, as this will have no effect.

Attaching the servlet.xml above will do the trick.