How can I get the current user roles from Spring security 3.1

Question

I have loaded the roles from the database for the current user. And I can access the user role with spring security expression in JSP, and can hide the options and URLs which are not authorized with hasRole. Now I wanted to have it in the servlet and display it in the logs (or store in the user object session). How can we achieve it?

Answer 1

You can try something like this:

Collection<SimpleGrantedAuthority> authorities = (Collection<SimpleGrantedAuthority>)    SecurityContextHolder.getContext().getAuthentication().getAuthorities(); 

You have the collection of roles in the authorities variable.

Answer 2

If you develop on Java 8, it's getting easier.

To get all user roles:

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();  Set<String> roles = authentication.getAuthorities().stream()      .map(r -> r.getAuthority()).collect(Collectors.toSet()); 

To check if the user has a particular role, for example, ROLE_USER:

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();  boolean hasUserRole = authentication.getAuthorities().stream()           .anyMatch(r -> r.getAuthority().equals("ROLE_USER"));