CODEWITHSUNDEEP
javaspringspring-mvcspring-security
sumit sinha
sumit sinha

Reputation: 3

Allow access to user in Spring Security if he has both roles

I am using Spring Security for providing access to users of my application. For single role I am using like this:

<security:intercept-url pattern="/rest/Admin" access="hasAuthority('Admin')" />

I want to provide access to user for a particular URL if he has both role of Admin and Employee but I am not sure how to do this.

Upvotes: 0

Views: 292

Answers (1)

jlumietu
jlumietu

Reputation: 6444

According to Spring Security Reference:

To use expressions to secure individual URLs, you would first need to set the use-expressions attribute in the <http> element to true. Spring Security will then expect the access attributes of the <intercept-url> elements to contain Spring EL expressions. The expressions should evaluate to a Boolean, defining whether access should be allowed or not. For example:

<http>
    <intercept-url pattern="/admin*"
        access="hasRole('admin') and hasIpAddress('192.168.1.0/24')"/>
    ...
</http>

So, you should try using:

<security:intercept-url pattern="/rest/Admin" 
    access="hasAuthority('Admin') and hasAuthority('Employee')" />

Upvotes: 2

Related Questions