Skip to content

Commit c3f766f

Browse files
committed
Update RoleHierarchy Documentation
Closes gh-15208
1 parent bce8035 commit c3f766f

File tree

1 file changed

+6
-9
lines changed

1 file changed

+6
-9
lines changed

docs/modules/ROOT/pages/servlet/authorization/architecture.adoc

+6-9
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,8 @@ Alternatively, you can modify every access constraint which requires the "user"
241241
This can get quite complicated if you have a lot of different roles in your application.
242242

243243
The use of a role-hierarchy allows you to configure which roles (or authorities) should include others.
244-
An extended version of Spring Security's `RoleVoter`, `RoleHierarchyVoter`, is configured with a `RoleHierarchy`, from which it obtains all the "reachable authorities" which the user is assigned.
245-
A typical configuration might look like this:
244+
This is supported for filter-based authorization in `HttpSecurity#authorizeHttpRequests` and for method-based authorization through `DefaultMethodSecurityExpressionHandler` for pre-post annotations, `SecuredAuthorizationManager` for `@Secured`, and `Jsr250AuthorizationManager` for JSR-250 annotations.
245+
You can configure the behavior for all of them at once in the following way:
246246

247247
.Hierarchical Roles Configuration
248248
[tabs]
@@ -260,7 +260,7 @@ static RoleHierarchy roleHierarchy() {
260260
.build();
261261
}
262262
263-
// and, if using method security also add
263+
// and, if using pre-post method security also add
264264
@Bean
265265
static MethodSecurityExpressionHandler methodSecurityExpressionHandler(RoleHierarchy roleHierarchy) {
266266
DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
@@ -292,13 +292,10 @@ Xml::
292292
----
293293
======
294294

295-
[NOTE]
296-
`RoleHierarchy` bean configuration is not yet ported over to `@EnableMethodSecurity`.
297-
As such this example is using `AccessDecisionVoter`.
298-
If you need `RoleHierarchy` support for method security, please continue using `@EnableGlobalMethodSecurity` until https://github.com/spring-projects/spring-security/issues/12783 is complete.
299-
300295
Here we have four roles in a hierarchy `ROLE_ADMIN => ROLE_STAFF => ROLE_USER => ROLE_GUEST`.
301-
A user who is authenticated with `ROLE_ADMIN`, will behave as if they have all four roles when security constraints are evaluated against an `AuthorizationManager` adapted to call the above `RoleHierarchyVoter`.
296+
A user who is authenticated with `ROLE_ADMIN`, will behave as if they have all four roles when security constraints are evaluated against any filter- or method-based rules.
297+
298+
[TIP]
302299
The `>` symbol can be thought of as meaning "includes".
303300

304301
Role hierarchies offer a convenient means of simplifying the access-control configuration data for your application and/or reducing the number of authorities which you need to assign to a user.

0 commit comments

Comments
 (0)