I have a web application which has 2 actors:
superAdmin & admin
The superAdmin can determine all permissions of admin(eg: admin will use "add" methode and won't use "delete")
SuperAdmin can change permissions for Admin in the web page (not the programmer)
So how can i do that? if someone can just tell me the big lines to follow.
PS: I'm using Spring MVC + Spring security+hibernate+jsp
Using Spring security you can add the paths and user access to them
<intercept-url pattern="/add.do" access="superAdmin, admin"/>
<intercept-url pattern="/delete.do" access="superAdmin"/>
Related
We are creating a spring boot web application to send RSS data to a Ticker Sign (ticker).
The URLs that send RSS data to the ticker sign do not need to be secured with ldap or other credentials.
But we have one page we we update a custom message that we send to the Ticker sign. We want to secure this page with the corporate ldap.
Is it possible to configure spring boot to only require a login for one page and the rest of the pages can remain unsecured.
You can create a role with all permission to access and grant that access just in some methods using Spring security annotation http://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html
<http use-expressions="true">
<intercept-url pattern="/*"
access="hasRole('admin')"/>
</http>
Then in your free access method
#PreAuthorize("hasRole('admin')")
public void create(Contact contact);
To use this it is very important that you name your URLs wisely i.e. if you want to assign admin role then make a URL look something like /admin/v1/something-here. It will make things readable and simple for you.
My Spring Web project with Spring Security works successfully. I want to separate "view" of the project by creating a new static web project. It will have a login screen, access to pages by user's role etc.
my spring-security.xml file
<http auto-config="true">
<intercept-url pattern=“/restricted” access="ROLE_ADMIN" />
<form-login login-page="/login"
default-target-url="/welcome"
authentication-failure-url=“/fail” />
<logout logout-success-url="/login" />
</http>
In addition to this, i have REST controllers that return JSON data; but they are stricted if user's role is not ROLE_ADMIN (.../restricted/getlist)
What do i have to do in static web page (client) side?
Thank you.
You can use Spring security tags :
<sec:authorize access="hasRole('ROLE_ADMIN')">
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/taglibs.html
How can I restrict access to web resources based on permission groups rather than roles in spring security?
For instance, suppose I have a permission group called Domain\Developers, how can I use it for access control?
I've tried to find a solution using expression based access control. Something similar to:
<sec:intercept-url pattern="/**" access="hasRole('USER_ROLE')" />
But instead of using hasRole I'd expect to have something like inGroup(). Couldn't find anything so far.
Could it be that there's no implementation out there for what I ask for and I'd have to implement it myself?
There are 2 Roles
1) ROLE_USER1
2)ROLE_USER2
I dont want to add every URI in spring-security.xml Example I have Manage User module, Where i can Create, Update, Delete and Read Users I have one controller named user controller. Mapping in that controller is
#RequestMapping (value="user/create")
#RequestMapping (value="user/list")
#RequestMapping (value="user/update")
#RequestMapping (value="user/delete")
I want ROLE_USER1 to only access "user/create" so in this case i have to add URI "user/create" for ROLE_USER1 role in secruity.xml
And ROLE_USER2 can access only "user/list" and "user/delete", In this case i have to add 2 URI's for ROLE_USER2 in security.xml
I want if this could happen somehow that i will always give /admin in URL that Admin role can access
And for SuperAdmin URL will contain /SuperAdmin
And I just have to give /Admin/** and /superAdmin/** in spring-security.xml
But to achieve the above scenario I have to add Multiple mappings in controller for single action. If I add multiple actions then i Have Jsp Action problem. i.e there could be either "/admin/user/create" or "/superAdmin/user/create"
I want to secure url's with minimum entries in Spring.security.xml
Regards
I don't think you should create a new Controller for admin and superadmin.
Instead you should just add the roles to the URL in security.xml. For example, if your current security.xml configuration is as below
<intercept-url pattern="/user/create" access="hasAnyRole('ROLE_USER1')" />
<intercept-url pattern="/user/delete" access="hasAnyRole('ROLE_USER2')" />
You just need to add admin and superadmin roles as below.
<intercept-url pattern="/user/create" access="hasAnyRole('ROLE_USER1', 'SuperAdmin', 'Admin')" />
<intercept-url pattern="/user/delete" access="hasAnyRole('ROLE_USER2', 'SuperAdmin', 'Admin')" />
In you Java code, if you have any special logic for different roles, you can access the current role as below and switch the logic.
SecurityContextHolder.getContext().getAuthentication().getAuthorities();
I am new in spring framework and little confused in managing the directory structure according to the role of user like admin (all jsp will be inside admin directory), how to make login according to the user role like admin will have access only to the admin directory and the session of the user it's time out etc.
I have used this website as reference for login management using hibernate :-
http://fruzenshtein.com/spring-mvc-security-mysql-hibernate/
what i want to do is to protect the user from seeing the pages, which they do not have permission in spring and my project is managing the directory as their role like admin - admin directory, user - user directory and other user - other directory and home pages, when admin will login he will have access to the pages inside admin.
Using hibernate security framework how can i do this.
You have to use SPRING security framework to achive that.
just add whatever filter you want to add in spring-security.xml.
For example: add
<intercept-url pattern="/admin/*" access="ROLE_ADMIN" />
<intercept-url pattern="/user/*" access="ROLE_USER" />
It will create check that accessing controller mapping starting with /admin* will require admin login.
Go through spring security docs then configure security with help of below link:
Steps for configuring spring security