defining userroles with inheriting rights
I'm currently looking into the spring-security framework - great stuff so far, pretty impressed. However, I haven't found out where or how to define a inheritance of permissions. e.g. I want the ROLE_ADMIN to have at least the same rights as the ROLE_USER. I defined three intercep-urls for spring: <intercept-url pattern="/auth/login.do" access="permitAll"/> <intercept-url pattern="/voting/*" access="hasRole('ROLE_USER')"/> <intercept-url pattern="/admin/*" access="hasRole('ROLE_ADMIN')"/> When trying to access any site nesting from /voting/, while being logged in as a ROLE_ADMIN user, I am