Applying Security to MVC methods

From architectural-level authorization, we go down to the access levels of our service and controller methods. This recipe will design a role-based authorization imposed on some essential transactions of the MVC application.

Getting started

We will utilize the same ch04 project, but this time we will focus on role-based authorization of the service and request methods.

How to do it...

1. Before we apply Spring Security on some service methods, let us open the UserServiceImpl class and add the following authorization: a super-user role to hradmin by adding ROLE_USER to its existing set of authorities; ROLE_ADMIN and ROLE_USER authorities to the "admin" account; and ROLE_USER authorization to the "sjctrags" account:

@Service("userService") 
public class UserServiceImpl implements UserService{ 
 
    // refer to sources 
  @Override 
  public Set<String> getuserRoles(String username) { 
    Map<String, Set<String>> roles = new HashMap<>(); 
...