Are multiple roles allowed in the @Secured annotation with Spring Security

Question

I would like to allow access to a particular method to more than one group of users. Is it possible in Spring Security 3.x to do such a thing using the @Secured annotation? Consider two groups (roles) OPERATOR and USER, would this code be valid:

     @Secured("ROLE_OPERATOR", "ROLE_USER")     public void doWork() {         // do useful processing     } 

Answer 1

You're almost there. Syntactically, you need to write it like this:

@Secured({"ROLE_OPERATOR", "ROLE_USER"}) public void doWork() { ... } 

This is because you're supplying multiple values to a single array attribute of the annotation. (Java syntactically special-cases handing in a single value, but now you need to do it “properly”.)

Answer 2

@Donal Fellows answer is correct for Spring apps. However, if you're working in Grails, you need to use the Groovy syntax for lists so the code would look like this

@Secured(["ROLE_OPERATOR", "ROLE_USER"]) public void doWork() { ... }