Expression regular in Authority of spring security - spring-boot

Question

I am trying to configure my API and restrict the access depending on the authority of the jwt, my authority has this format: "ROLE_MON|1", or "ROLE_MON|2" or "ROLE_MON|3", etc, the number after the character '|' can be any number.
I configured like this:
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/users").access("hasAuthority('^ROLE_MON\\|[0-9]+$')")
.anyRequest().authenticated();
But doesn't work.
Note: Without regex this works, for example
.antMatchers("/users").access("hasAuthority('ROLE_MON|1')")
works for authority 'ROLE_MON|1'
I am using this version of springBoot:
plugins {
id 'java'
id 'org.springframework.boot' version '2.6.13'
id 'io.spring.dependency-management' version '1.0.15.RELEASE'
}
My dependences:
implementation(group: 'org.springframework.security.oauth', name: 'spring-security-oauth2', version: '2.5.2.RELEASE'){
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}
implementation(group: 'org.springframework.security.oauth.boot', name: 'spring-security-oauth2-autoconfigure', version: '2.6.8'){
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}
implementation(group: 'org.springframework.boot', name: 'spring-boot-starter-security'){
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}
implementation(group: 'org.springframework.security', name: 'spring-security-jwt', version: '1.0.9.RELEASE'){
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
}
I tried:
antMatchers("/users").access("hasAuthority('^ROLE_MON.*')")
and
antMatchers("/users").access("hasAuthority('^ROLE_MON.+')")
But doesn't work

Answer 1

This is not possible using the default RoleVoter
Spring security only checks for string equality so you can't use a regex here. In the examples you have given the token is being checked for the literal strings^ROLE_MON.* and ^ROLE_MON.+ in your token respectively, which do not exist. There are a few ways of working around this and the best solution will depend on your needs.
Write your own AccessDecisionVoter to provide REGEX matching:
You can write a custom AccessDecisionVoter that can accept a regular expression. If you aren't able to enumerate your existing roles (perhaps because they are dynamically generated or because there are many of them), this will be your only best solution.
Create a generic role that you can use to give privileges to your existing roles:
If you want all of these roles to be able to access this endpoint, you can add them to a role hierarchy under a generic role such that each ROLE_MON|.* has the permissions of the generic role. You can then add the generic role's name to the hasAuthority string and use that to configure access to your endpoints. This will only be possible if you can reasonably enumerate the roles you want to use.
Use hasAnyAuthority and a list of roles
This method allows you to provide a list or roles, for example:
antMatchers("/users").access("hasAnyAuthority('ROLE_MON|1','ROLE_MON|2','ROLE_MON|3')")
This will be the easiest solution if the number or roles is small and will not be difficult to maintain, but can be ugly or impossible depending how many roles you have.