Spring Security - Roles and Privileges

Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications. One of the key aspects of Spring Security is its ability to manage roles and privileges effectively. Roles and privileges are fundamental concepts in security that help in defining who can access what resources within an application. In this blog post, we will explore the concepts of roles and privileges in Spring Security, understand how they work, and see some best practices and example usage.

Table of Contents#

  1. Understanding Roles and Privileges
    • What are Roles?
    • What are Privileges?
    • Relationship between Roles and Privileges
  2. Spring Security Configuration for Roles and Privileges
    • Setting up a Spring Boot Project
    • Configuring Spring Security
    • Defining Roles and Privileges
  3. Common Practices and Best Practices
    • Role Hierarchy
    • Role-Based Access Control (RBAC)
    • Using Enums for Roles and Privileges
  4. Example Usage
    • Securing a RESTful API
    • Protecting Web Pages
  5. Conclusion
  6. References

1. Understanding Roles and Privileges#

What are Roles?#

A role is a high - level abstraction that represents a set of responsibilities or a position within an organization. For example, in an e - commerce application, roles could be "ADMIN", "USER", "MANAGER". Roles are used to group users based on their job functions or access levels.

What are Privileges?#

Privileges are specific permissions that allow users to perform certain actions. For instance, in the same e - commerce application, privileges could be "CREATE_PRODUCT", "UPDATE_PRODUCT", "DELETE_PRODUCT". Privileges are more granular than roles and define the actual operations a user can perform.

Relationship between Roles and Privileges#

A role can have multiple privileges associated with it. For example, an "ADMIN" role might have all the privileges such as "CREATE_PRODUCT", "UPDATE_PRODUCT", "DELETE_PRODUCT", while a "USER" role might only have the privilege to "VIEW_PRODUCT". This relationship helps in managing access control more effectively.

2. Spring Security Configuration for Roles and Privileges#

Setting up a Spring Boot Project#

First, create a new Spring Boot project using Spring Initializr (https://start.spring.io/). Add the following dependencies:

  • Spring Web
  • Spring Security

Configuring Spring Security#

Create a configuration class that extends WebSecurityConfigurerAdapter to configure Spring Security.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
 
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
           .authorizeRequests()
               .antMatchers("/public/**").permitAll()
               .antMatchers("/admin/**").hasRole("ADMIN")
               .anyRequest().authenticated()
               .and()
           .formLogin()
               .and()
           .httpBasic();
    }
 
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Defining Roles and Privileges#

You can define roles and privileges in various ways. One common approach is to use an InMemoryUserDetailsManager to create users with roles.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 
@Configuration
public class UserDetailsConfig {
 
    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withUsername("admin")
               .password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
               .roles("ADMIN")
               .build();
        UserDetails user = User.withUsername("user")
               .password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
               .roles("USER")
               .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

3. Common Practices and Best Practices#

Role Hierarchy#

Spring Security allows you to define a role hierarchy. This means that a user with a higher - level role automatically has the privileges of all the lower - level roles. For example:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
import org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl;
 
@Configuration
public class RoleHierarchyConfig {
 
    @Bean
    public RoleHierarchy roleHierarchy() {
        RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
        roleHierarchy.setHierarchy("ROLE_ADMIN > ROLE_MANAGER > ROLE_USER");
        return roleHierarchy;
    }
}

Role - Based Access Control (RBAC)#

RBAC is a widely used access control model. In Spring Security, you can implement RBAC by associating roles with different parts of your application. For example, you can restrict access to certain endpoints based on the user's role.

Using Enums for Roles and Privileges#

Using enums to define roles and privileges makes the code more maintainable and less error - prone.

public enum UserRole {
    ADMIN,
    MANAGER,
    USER
}
 
public enum UserPrivilege {
    CREATE_PRODUCT,
    UPDATE_PRODUCT,
    DELETE_PRODUCT,
    VIEW_PRODUCT
}

4. Example Usage#

Securing a RESTful API#

Let's assume you have a RESTful API with different endpoints. You can secure these endpoints based on roles and privileges.

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
public class ProductController {
 
    @GetMapping("/products")
    public String getProducts() {
        return "List of products";
    }
 
    @GetMapping("/admin/products")
    public String getAdminProducts() {
        return "Admin products";
    }
}

In the SecurityConfig class, you can configure the access rules:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
       .authorizeRequests()
           .antMatchers("/products").hasAnyRole("USER", "ADMIN")
           .antMatchers("/admin/products").hasRole("ADMIN")
           .anyRequest().authenticated()
           .and()
       .formLogin()
       .and()
       .httpBasic();
}

Protecting Web Pages#

If you have a web application, you can protect different pages based on roles. For example, you can use Thymeleaf to conditionally display content based on the user's role.

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
<head>
    <title>Home Page</title>
</head>
<body>
    <h1>Welcome to the Home Page</h1>
    <div sec:authorize="hasRole('ADMIN')">
        <p>This content is only visible to admins.</p>
    </div>
    <div sec:authorize="hasRole('USER')">
        <p>This content is visible to users.</p>
    </div>
</body>
</html>

5. Conclusion#

In this blog post, we have explored the concepts of roles and privileges in Spring Security. We have seen how to configure Spring Security to manage roles and privileges, and we have learned about common practices and best practices. By using roles and privileges effectively, you can ensure that your application is secure and that users have the appropriate access to resources.

6. References#

2026-07