Spring Security Permission Based framework

In my recent project, I want to implement permission based framework with spring security grails plugin.

What does permission based framework mean?

We can create a ROLE at run time based on the permission given to the user. Most of the times, we use Spring security in a way where we pre-define the roles to be used in our apps. But with the use of Permission, we can define the role at run time and assign permission as per our requirement.

Let’s take an example : Suppose we have a controller named as PersonController

[java]
class PersonController {

@Secured(‘ROLE_PERMISSION_PERSON_CREATE’)

def create(){….}

@Secured(‘ROLE_PERMISSION_PERSON_EDIT’)

def edit(){…}

@Secured(‘ROLE_PERMISSION_PERSON_SHOW’)

def show(){….}

@Secured(‘ROLE_PERMISSION_PERSON_DELETE’)
def delete(){….}
}

[/java]

In this example, we have defined four action, We want to create 2 roles like this :-

• Edit Person: This role has permissions like edit, create, delete, show.
• Show Person : This role has permissions like show.

So, for this, we have to define the different permissions to each action or may be you can define same permission to different action as same as we are defining roles in our projects.

After that, we have to add a new domain named as Permission, we have to define the many to many relationship with Role domain.

Role.groovy

[java]
class Role implements Serializable {

String authority
Date dateCreated
Date lastUpdated

static hasMany = [permissions:Permission]

static mapping = {
cache true
}

static constraints = {
authority blank: false, unique: true
}
}
[/java]

Permission.groovy

[java]
class Permission implements Serializable {

String name
static constraints = {
}
}
[/java]

In Bootstrap.groovy, you can bootstrap roles and permissions. See the code snippet below:

Firstly you have to save different type of permissions that mentioned above the action name in @secured annotation and assign permission to each role as per your requirements.

[java]
Permission createPermission = new Permission(name: ‘PERSON_CREATE’)
createPermission.save()

Permission editPermission = new Permission(name: ‘PERSON_EDIT’)
editPermission.save()

Permission deletePermission = new Permission(name: ‘PERSON_DELETE’)
deletePermission.save()

Permission showPermission = new Permission(name: ‘PERSON_SHOW’)
showPermission.save()

Role editRole = new Role(authority: ‘ROLE_EDIT_PERSON’, permissions: [createPermission, deletePermission, showPermission, editPermission])
editRole.save()

Role showRole = new Role(authority: ‘ROLE_SHOW_PERSON’, permissions: [showPermission])
showRole.save()
[/java]

You can create as many as can roles at run time and assign permissions to each role.

You have to create one class in src/groovy package CustomAuthority which will extends the GrantedAuthority
class.

[java]
import org.springframework.security.core.GrantedAuthority

class CustomAuthority implements GrantedAuthority {
private String authority;

public CustomAuthority(String authority) {
this.authority = authority;
}

@Override
public String getAuthority() {
return authority;
}

@Override
public int hashCode() {
return authority.hashCode();
}

@Override
public boolean equals(Object obj) {
if(obj == null) return false;
if(!(obj instanceof CustomAuthority)) return false;
return ((CustomAuthority) obj).getAuthority().equals(authority);
}
}
[/java]

Now, you have to override getAuthorities() method of the User.groovy file to use the permission for each role specific to users.

[java]
Set getAuthorities() {
Set list = UserRole.findAllByUser(this).collect { it.role } as Set
def roles = new HashSet()
roles.addAll(list)
def newRoles = new HashSet()
list.each { role ->
role?.permissions?.each { permission ->
CustomAuthority customAuthority = new CustomAuthority("ROLE_PERMISSION_" + permission.name);
newRoles.add(customAuthority);
}
}
return newRoles
}
[/java]

In this method, we are getting the different permissions from each role and assigning them to authority list.

Now, your permission based framework is configured.

It’s very powerful way to customize the roles in spring security, you don’t need to change the code when creating the role, you can customize roles based on permissions at run time.

Hope this blog will give you the idea to integrate the spring security with permissions.