Spring Security endpoint protection by dynamic roles - spring-boot

Question

Have a doubt regarding protecting endpoints by user roles. I have a endpoint "/message" it is protected in either of two ways as shown below
1) In Controller as follows
#PreAuthorize("hasAuthority('USER')")
#RequestMapping(value = "/message", method = RequestMethod.GET)
public String message() {
return "Hello World!!!"
}
2) In configuration(WebSecurityConfigurereAdapter) file as follows
#Override
public void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests().anyRequest().authenticated()
.antMatchers(HttpMethod.GET, "/message").access("hasAuthority('USER')");
}
As it can be seen role USER has been hard coded in both ways, how can this be achieved dynamically, one way is we can read from database in configuration file and build HttpSecurity, but this happens during start of the application, how can endpoints be protected by new roles created at runtime?

Answer 1

Best way to protect your endpoints that can be changed anytime:
In case if you want to grant/revoke roles/permission from a user, the best approach would be to play with privileges instead of roles. In that case, each user will have just one role. And each role may have a list of privileges, that can be added/removed from a role anytime using UI.
How to do?
public class Privilege{
#Id
private String id;
private String name;
//Constructors + Getters & Setters
}
public class Role{
#Id
private String id;
private String name;
private List<Privilege> privileges;
//Constructors + Getters & Setters
}
public class MyUser{
private Role role;
//All Required params
//Constructors + Getters & Setters
}
public class MyUserDetailsService implements UserDetailsService{
public User loadUserByUsername(final String userId) {
User user = //load your user
Role role = //load above user role
Collection<GrantedAuthority> grantedAuthorities.add(new SimpleGrantedAuthority(merchantRole.getName()));
for(Privilege privilege : role.getPrivileges()){
grantedAuthorities.add(new SimpleGrantedAuthority(privilege.getName()));
}
return new User(username, password, grantedAuthorities);
}
}
And finally your configuration file should look like this:
#Override
public void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests().anyRequest().authenticated()
.antMatchers(HttpMethod.GET, "/message").access("hasAuthority('YOUR_PRIVILAGE')");
}
Note
Try to create privileges as indivisible as possible. Mean to say each privilege should be specific to each specific task. So that anytime any role can be created with any combination of privileges without changing antMatchers/security.
Example:
CREATE_USER_PRIVILEGE
UPDATE_USER_PRIVILEGE
DELETE_USER_PRIVILEGE
VIEW_USER_PRIVILEGE
etc.
ADMIN_ROLE = {CREATE_USER_PRIVILEGE, UPDATE_USER_PRIVILEGE, DELETE_USER_PRIVILEGE, VIEW_USER_PRIVILEGE}
ADMIN_ROLE = {VIEW_USER_PRIVILEGE}
etc.