How do I use custom roles/authorities in Spring Security?

Question

While migrating a legacy application to spring security I got the following exception:

org.springframework.beans.factory.BeanCreationException: Error creatin         


        

Answer 1

This might also help:

http://forum.springsource.org/showthread.php?96391-Spring-Security-Plug-in-ROLE_-prefix-mandatory

Bassically, it says you have to write in grails-app/conf/spring/resources.groovy:

roleVoter(org.springframework.security.access.vote.RoleVoter) {
    rolePrefix = ''
}

It worked for me.

Answer 2

You are using the default configuration which expects that roles starts with the "ROLE_" prefix. You will have to add a custom security configuration and set rolePrefix to "";

http://forum.springsource.org/archive/index.php/t-53485.html

Answer 3

Here is a complete configuration using access expressions (link provided by @rodrigoap seems a little bit outdated):

<http
        access-decision-manager-ref="accessDecisionManager"
        use-expressions="true">

<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:property name="decisionVoters">
        <beans:list>
            <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
            <beans:bean class="org.springframework.security.access.vote.RoleVoter">
                <beans:property name="rolePrefix" value=""/>
            </beans:bean>
            <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
        </beans:list>
    </beans:property>
</beans:bean>

Answer 4

You can also always using expression (by config use-expressions="true") to ignore ROLE_ prefix.

After reading Spring Security 3.1 source code, I found when use-expressions="true" :

For <security:http >:
HttpConfigurationBuilder#createFilterSecurityInterceptor() will regist WebExpressionVoter but not RoleVoter、AuthenticatedVoter;

For <security:global-method-security >: GlobalMethodSecurityBeanDefinitionParser#registerAccessManager() will regist PreInvocationAuthorizationAdviceVoter (conditionally), then always regist RoleVoter、AuthenticatedVoter, regist Jsr250Voter conditionally;

PreInvocationAuthorizationAdviceVoter will process PreInvocationAttribute （PreInvocationExpressionAttribute will be used as implementation） which is generated according @PreAuthorize. PreInvocationExpressionAttribute#getAttribute() always return null, so RoleVoter、AuthenticatedVoter do not vote it.

Answer 5

Using Spring Security 3.2, this worked for me.

Change Role Prefix:

<beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
    <beans:property name="rolePrefix" value="NEW_PREFIX_"/>
</beans:bean>

<beans:bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter"/>   

<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:constructor-arg >
        <beans:list>
            <beans:ref bean="roleVoter"/>
            <beans:ref bean="authenticatedVoter"/>
        </beans:list>
    </beans:constructor-arg>
</beans:bean>

Depending on where you want to apply the Role Prefix it can be applied at the Security schema level or bean level.

<http access-decision-manager-ref="accessDecisionManager" use-expressions="true">

Apply Role Prefix at Service Level:

<beans:bean id="myService" class="com.security.test">
    <security:intercept-methods  access-decision-manager-ref="accessDecisionManager">
        <security:protect access="NEW_PREFIX_ADMIN"/>
    </security:intercept-methods>
</beans:bean>