How can I secure Spring controller methods for user roles?

Question

I have USER, ROLE and USER_ROLE tables and a bunch Spring controllers ... is there an Spring annotation I can add to the controller methods that will specify the role(s) a user should have to be able to access it?

I guess it's going to be Spring security? Is that straighforward to wire up to an existing user/role schema?

I'm using Spring 2.5.4.

Answer 1

Spring Security is going to be your easiest way to do it. What you're asking for specifically is Method Security Expressions. You can achieve this by using the following:

@PreAuthorize("hasRole('ROLE_ADMIN')")
public void deleteUser(User user) {
  ...
}

It's pretty straightforward to set up Spring Security with a database backend. I'd take a look at the DAOAuthenticationProvider as a starting point.