How do I use custom roles/authorities in Spring Security?

Question

While migrating a legacy application to spring security I got the following exception:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_filterChainProxy': Initialization of bean failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_filterChainList': Cannot resolve reference to bean '_filterSecurityInterceptor' while setting bean property 'filters' with key [3]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '_filterSecurityInterceptor': Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: Unsupported configuration attributes: [superadmin] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:480) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory$1.run(AbstractAutowireCapableBeanFactory.java:409) at java.security.AccessController.doPrivileged(Native Method) at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:380) at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:264) 

In the old application there are roles like "superadmin", "editor", "helpdesk" etc. But in all Spring Security examples I only see roles like "ROLE_" ("ROLE_ADMIN" etc). When I rename "superadmin" to "ROLE_ADMIN" and only use this role in the config, everything works.

Doesn't work:

 <http auto-config="true">                                           <intercept-url pattern="/restricted/**" access="superadmin"/>     <form-login         authentication-failure-url="/secure/loginAdmin.do?error=true"         login-page="/secure/loginAdmin.do" />         </http>  

Works:

<http auto-config="true">                                           <intercept-url pattern="/restricted/**" access="ROLE_ADMIN"/>     <form-login         authentication-failure-url="/secure/loginAdmin.do?error=true"         login-page="/secure/loginAdmin.do" />         </http>  

Is possible to use custom role names?

Answer 1

You are using the default configuration which expects that roles starts with the "ROLE_" prefix. You will have to add a custom security configuration and set rolePrefix to "";

http://forum.springsource.org/archive/index.php/t-53485.html

Answer 2

Here is a complete configuration using access expressions (link provided by @rodrigoap seems a little bit outdated):

<http         access-decision-manager-ref="accessDecisionManager"         use-expressions="true">  <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">     <beans:property name="decisionVoters">         <beans:list>             <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>             <beans:bean class="org.springframework.security.access.vote.RoleVoter">                 <beans:property name="rolePrefix" value=""/>             </beans:bean>             <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>         </beans:list>     </beans:property> </beans:bean>