Tukukkk

im trying to secure my endpoints with role based access control. I have implemented the whole structure as well as CustomUserDetailService, however im not sure how should i enforce these rules on enpoints, i was looking for some nice annotation based evaluation like @PreAuthorize(hasRole('role')). My structure looks follwoing:

Permission:

@Entity

public class Permission implements GrantedAuthority {



@Id

private Long id;



@Column(name = "NAME")

private String name;



@ManyToMany(mappedBy = "permissions",  fetch = FetchType.LAZY)

private Collection<Role> roles;



@Override

public String getAuthority() {

    return name;

}

Role:

@Entity

public class Role implements GrantedAuthority {



@Id @Column(name="ID" )

private Long id;



@Column(name="NAME", nullable=false , unique=false)

private String name;



@ManyToMany(fetch = FetchType.LAZY)

@JoinTable(

        name = "role_x_permission",

        joinColumns = @JoinColumn(

                name = "role_id"),

        inverseJoinColumns = @JoinColumn(

                name = "permission_id"))

private List<Permission> permissions;



@Override

public String getAuthority() {

    return name;

}

User:

@Entity(name = "User")

@Table(name = "USERS")

@Data

public class User {



@Id

private Long id;



@Column(name="LOGIN"   , nullable=true , unique=false)

private String login;



@Column(name="PASSWORD"   , nullable=false , unique=false)

private String password;



@ManyToMany( fetch = FetchType.LAZY)

@JoinTable(name = "USER_ROLES",

        joinColumns = @JoinColumn(name = "user_id"),

        inverseJoinColumns = @JoinColumn(name = "role_id"))

private Set<Role> roles;

Now i have defined my CustomUserDetailsService:

@Service

public class UserDetailsServiceImpl implements UserDetailsService {



@Autowired

private UserRepository userRepository;





@Override

@Transactional

public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

    User applicationUser = userRepository.findByUsername(username);

    if (applicationUser.getId() == null) {

        throw new UsernameNotFoundException(username);

    }

    return new org.springframework.security.core.userdetails.User(applicationUser.getLogin(), applicationUser.getPassword(),

            getAuthorities(applicationUser.getRoles()));

}



@Transactional

public Collection<? extends GrantedAuthority> getUserAuthorities(String username) {

    User user = userRepository.findByUsername(username);



    return getAuthorities(user.getRoles());

}



private Collection<? extends GrantedAuthority> getAuthorities(

        Collection<Role> roles) {



    return getGrantedAuthorities(getPermissions(roles));

}



private List<String> getPermissions(Collection<Role> roles) {



    List<String> permissions = new ArrayList<>();

    List<Permission> collection = new ArrayList<>();

    for (Role role : roles) {

        collection.addAll(role.getPermissions());

    }

    for (Permission item : collection) {

        permissions.add(item.getName());

    }

    return permissions;

}



private List<GrantedAuthority> getGrantedAuthorities(List<String> permissions) {

    List<GrantedAuthority> authorities = new ArrayList<>();

    for (String permission : permissions) {

        authorities.add(new SimpleGrantedAuthority(permission));

    }

    return authorities;

}

}

Then i'm trying to annotate my endpoint with @PreAuthorize

@PostMapping("/doSomething")

@PreAuthorize("hasRole('doSomething')")

public SomeEntity createComment(@RequestBody SomeEntity something) {

   ...

}

I have user with role of USER, this role doesn't have permission to doSomething, however it seems like @PreAuthorize("hasRole('doSomething')") is not working. I'm not sure what i have done wrong, coule you please point my mistake?

Also, since im using RBAC this hasRole is very missleading since access is permission based, not role based.

What would be correct way to authorize access to endpoint with RBAC approach?

You should use hasAuthority('doSomething') instead of hasRole('doSomething').

Role is just a permission with a prefix Role_.

So hasRole('XXX') is same as hasAuthority('ROLE_XXX')