You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/modules/ROOT/pages/servlet/authorization/architecture.adoc
+6-9
Original file line number
Diff line number
Diff line change
@@ -241,8 +241,8 @@ Alternatively, you can modify every access constraint which requires the "user"
241
241
This can get quite complicated if you have a lot of different roles in your application.
242
242
243
243
The use of a role-hierarchy allows you to configure which roles (or authorities) should include others.
244
-
An extended version of Spring Security's `RoleVoter`, `RoleHierarchyVoter`, is configured with a `RoleHierarchy`, from which it obtains all the "reachable authorities" which the user is assigned.
245
-
A typical configuration might look like this:
244
+
This is supported for filter-based authorization in `HttpSecurity#authorizeHttpRequests` and for method-based authorization through `DefaultMethodSecurityExpressionHandler` for pre-post annotations, `SecuredAuthorizationManager` for `@Secured`, and `Jsr250AuthorizationManager` for JSR-250 annotations.
245
+
You can configure the behavior for all of them at once in the following way:
DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
@@ -292,13 +292,10 @@ Xml::
292
292
----
293
293
======
294
294
295
-
[NOTE]
296
-
`RoleHierarchy` bean configuration is not yet ported over to `@EnableMethodSecurity`.
297
-
As such this example is using `AccessDecisionVoter`.
298
-
If you need `RoleHierarchy` support for method security, please continue using `@EnableGlobalMethodSecurity` until https://github.com/spring-projects/spring-security/issues/12783 is complete.
299
-
300
295
Here we have four roles in a hierarchy `ROLE_ADMIN => ROLE_STAFF => ROLE_USER => ROLE_GUEST`.
301
-
A user who is authenticated with `ROLE_ADMIN`, will behave as if they have all four roles when security constraints are evaluated against an `AuthorizationManager` adapted to call the above `RoleHierarchyVoter`.
296
+
A user who is authenticated with `ROLE_ADMIN`, will behave as if they have all four roles when security constraints are evaluated against any filter- or method-based rules.
297
+
298
+
[TIP]
302
299
The `>` symbol can be thought of as meaning "includes".
303
300
304
301
Role hierarchies offer a convenient means of simplifying the access-control configuration data for your application and/or reducing the number of authorities which you need to assign to a user.
0 commit comments