Is my approach of giving access to users correct?

Question

I am applying spring security on my jsp page, I need to show different parts of the page to users with different roles all the roles are as following.

All authenticated users >> Edit and Add New

Admin > Delete and Edit and Add New

Anonymous > Add New

<sec:authorize
        access="isAuthenticated()">
          Code of add new and edit buttons
 </sec:authorize>

 <sec:authorize 
         access="hasAnyRole('ADMIN')">
   Code to add new, edit and delete buttons
 </sec:authorize>

  <sec:authorize 
         access="isAnonymous()">
     Code to add new
  </sec:authorize>

I am wondering if there is any easier method, in this case, if I want to modify access of a specific role I have to change its access rules in security.xml file and every page that I have set the role access.

For example, lets say I want to unable Admin role to access delete button then I have to change the code of security.xml and all the JSP pages that admin role was authenticated to view delete button.

Is there any easier method to do it!?

Answer 1

There can be a solution by using rights set which can be contained in role object as a collection.

After this implementation you can check the right permission for showing buttons and if you want to change anything in your security architecture, you can easily manage this by granting or revoking the rights from related role.

An example of this can bee seen in the link below.

http://en.tekstenuitleg.net/blog/spring-security-with-roles-and-rights