From architectural-level authorization, we go down to the access levels of our service and controller methods. This recipe will design a role-based authorization imposed on some essential transactions of the MVC application.
We will utilize the same ch04 project, but this time we will focus on role-based authorization of the service and request methods.
- Before we apply Spring Security on some service methods, let us open the
UserServiceImplclass and add the following authorization: a super-user role tohradminby addingROLE_USERto its existing set of authorities;ROLE_ADMINandROLE_USERauthorities to the "admin" account; andROLE_USERauthorization to the "sjctrags" account:
@Service("userService")
public class UserServiceImpl implements UserService{
// refer to sources
@Override
public Set<String> getuserRoles(String username) {
Map<String, Set<String>> roles = new HashMap<>();
...