Spring security access with multiple roles

Question

I want to define access for some pages for user who has one of following roles (ROLE1 or ROLE2)

I'm trying to configure this in my spring security xml file as following:

<security:http entry-point-ref="restAuthenticationEntryPoint" access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security" use-expressions="true">
        <!-- skipped configuration -->
        <security:intercept-url pattern="/rest/api/myUrl*" access="hasRole('ROLE1') or hasRole('ROLE2')" />

        <!-- skipped configuration -->
    </security:http>

I've tried various ways like:

access="hasRole('ROLE1, ROLE2')"
access="hasRole('ROLE1', 'ROLE2')"
access="hasAnyRole('[ROLE1', 'ROLE2]')"

etc

but nothing seems to be working.

I'm keep getting exception

java.lang.IllegalArgumentException: Unsupported configuration attributes:

or

java.lang.IllegalArgumentException: Failed to parse expression 'hasAnyRole(['ROLE1', 'ROLE2'])'

how should it be configured?

Thanks

Answer 1

How try with , separate. See doc here and here.

<security:intercept-url pattern="/rest/api/myUrl*" access="ROLE1,ROLE2"/>

OR

hasAnyRole('ROLE1','ROLE2')