antMatchers allow ADMIN all routes while other roles are restricted - spring-boot

Question

Specific user groups should have access to different api-routes. Given the following HttpSecurity we, for example, allow CUSTOMER to access GET /invoices/*. Also, I want to allow ADMIN to access any route /**.
#Override
protected void configure(HttpSecurity http) throws Exception {
http = http
.cors().and()
.csrf().disable(); // REST only
// ### Authentication
// ...
// ### Authorization
// anonymous (and all other roles)
e = e
.antMatchers(HttpMethod.POST,
"/user/account/create",
"/user/account/confirm/*",
"/feedback")
.permitAll()
.antMatchers(HttpMethod.GET,
"/" + StorageController.STORAGE_RELATIVE_PATH, // public files
"/translations/*")
.permitAll();
// role CUSTOMER
e = e
.antMatchers(HttpMethod.GET,
"/invoices",
"/invoices/*")
.hasRole(Role.CUSTOMER.toString())
.antMatchers(HttpMethod.PUT,
"/profile",
"/contracts/billingAddress")
.hasRole(Role.CUSTOMER.toString())
.antMatchers(HttpMethod.POST,
"/contracts",
"/profile/logo")
.hasRole(Role.CUSTOMER.toString());
// only ADMIN
e = e.antMatchers("/**").hasRole(Role.ADMIN.toString());
}
While ADMIN is allowed to use all non-mentioned /admin/.../ routes, the role get's a 403 on, for example, /invoices/* - why? From what I understand the specified configuration depends on the order and hence requires /invoices/* to have CUSTOMER role and hence ADMIN is not enough - correct?
If I add the following (section CUSTOMER or ADMIN), it works, but it is so cumbersome to always list ADMIN role. I just want ADMINs to be able to access everything.
#Override
protected void configure(HttpSecurity http) throws Exception {
// ...
// role CUSTOMER
e = e
// ... as above ...
// CUSTOMER or ADMIN
e = e
.antMatchers(HttpMethod.GET,
"/invoices/*") // AGAIN
.hasAnyRole(Role.CUSTOMER.toString(),
Role.ADMIN.toString());
// only ADMIN
e = e.antMatchers("/**").hasRole(Role.ADMIN.toString());
}
Also, I cannot put the ADMIN rule above the others, because it would exclude the other roles from accessing anything. Is there a way to specify what I want to do in a more elegant/easier way?

Answer 1

As you indicated in your question, this behaviour occurs because each matcher is considered in the order it was declared.
A request to /invoices will reach the below matcher first and since it is a match, it will apply the associated rule.
.antMatchers("/invoices").hasRole("CUSTOMER")
If the user making the request only has the role "ADMIN" then they will be denied access, because an "ADMIN" is not a "CUSTOMER".
Option 1
To get the desired behaviour you can explicitly list out the roles that have access to the endpoint.
As you mentioned, this is verbose, however, the advantage is that it clearly indicates the allowed roles in one place.
.antMatchers("/invoices").hasAnyRole("CUSTOMER", "ADMIN")
Option 2
If an "ADMIN" should be able to do anything a "CUSTOMER" can do, then you can declare a RoleHierarchy that states that any "ADMIN" is also a "CUSTOMER".
#Bean
public RoleHierarchy roleHierarchy() {
RoleHierarchyImpl hierarchy = new RoleHierarchyImpl();
hierarchy.setHierarchy("ROLE_ADMIN > ROLE_CUSTOMER");
return hierarchy;
}
The > symbol can be thought of as meaning "includes".
Then, any endpoints protected by .hasRole("CUSTOMER") can also be accessed by users with the role "ADMIN", since having the role "ADMIN" implies that they also have the role "CUSTOMER".