CODEWITHSUNDEEP
springauthenticationspring-securityauthorization
WebStormer
WebStormer

Reputation: 256

Spring Security: Creating multiple entry point for securing different rest controllers

I'm exploring the Spring framework, and in particular I am working on a Cinema Management Application that will be connected to a React.JS SPA (Single Page Application).

The problem is the following. On my database I do have three different tables representing three different types of users, namely Admin, Customer, and Cinema_Employee.

For each type of user, I created a @RestController with a list of RequestMethods that a particular user is able to perform:

"/admin" 
"/customer"
"/employee"

What I am trying to achieve now, it's to secure each endpoint offering three different login pages that will handle the authentication the respective type of user.

How can I set up three AuthenticationManager that handle different Authentication objects within a SecurityConfig class given these requirements, and most importantly, how can I override the Authorisation mindful that each user once has logged in, will have access only to the respective endpoint?

I looked carefully at other examples online, and most of them are radical different, following a pattern where the database has another additional 'Authorities' table aside the 'user' one that stores the credential. In my case this solution cannot be applied, not only because the whole design would become redundant, but also because the name of the table where the application will perform the authentication check against, explicitly imply the authorisation that a given user has inside the system.

Upvotes: 0

Views: 225

Answers (1)

Elmar Brauch
Elmar Brauch

Reputation: 1376

Your design sounds strange to me.
A user should have a role, e.g. Admin, Customer, Employee and based on the user's role he gets access to methods or not. Have a look at role based access control concepts. For Spring Security there is for example this tutorial:
https://www.baeldung.com/role-and-privilege-for-spring-security-registration

Upvotes: 1

Related Questions