Best way to handle multiply roles in spring security [duplicate] - spring

Question

This question already has answers here:
AuthenticationSuccessHandler in Spring Security
(2 answers)
Closed 3 years ago.
I'm building a web application as a pet project using spring modules and hibernate.
I want to redirect users with different authorities to different pages.
So far I have my WebSecurityConfigurerAdapter:
#EnableWebSecurity
public class ConfigSecurity extends WebSecurityConfigurerAdapter {
#Autowired
UserDetailsService userDetailsService;
#Autowired
public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception {
PasswordEncod encodde = new PasswordEncod();
auth.userDetailsService(userDetailsService).passwordEncoder(new PasswordEncod());
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/curator").authenticated();
http.formLogin()
.loginPage("/login")
.failureUrl("/login?error")
.usernameParameter("j_username")
.passwordParameter("j_password")
.permitAll().and().csrf().disable();
}
}
and custom UserDetails service :
public class MyUserDetailsService implements UserDetailsService {
UserDao dao = new UserDaoImpl();
#Override
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
System.out.println(s);
User user = dao.getByUsername(s);
System.out.println(user.toString());
return
new org.springframework.security.core.userdetails
.User(
user.getUsername(),
user.getPassword(),
buildUserAuthority(user));
}
private List<GrantedAuthority> buildUserAuthority(User user) {
Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();
for (UserRole userRole : user.getUserRoles()) {
setAuths.add(new SimpleGrantedAuthority(userRole.toString()));
}
List<GrantedAuthority> Result = new ArrayList<GrantedAuthority>(setAuths);
return Result;
}
}
I want to make a login page that will redirect the customer to the default user or admin page depending on his authorities but I don't understand which would be the best practice to do so. I've thought about making a controller that will do the job but I think that there is a better solution. Am I doing ok, maybe you could suggest me some improvements or the ways to do it?

Answer 1

For redirection follow this - spring security redirect based on role. But for your situation once you have configured :
antMatchers("/curator").authenticated()
...
antMatchers("/some-action-**").access("hasAuthority('ADMIN')")
Simply use Spring Security Tags to hide the links. Say for example, use security tag to hide links for normal users where some admin role is required. If above is configured properly, normal users will get access denied even if they try to access the secured URL. Let Spring-Security do the hard (security) work for you. For the full blown example you can refer this, this and finally this.