Method level access controls with Spring Boot

Question

Method level security annotations are blocking all user types, including the one which should be permitted, and I don't know why.

The security configuration file includes annotations which I believe should allow method level security, and antMatchers to decide what the roles ADMIN and MAKER should be able to access. These do work, but the /quilts etc mappings go to controllers which have some methods that I only want MAKERs to be able to use, and others which should only be for ADMIN.

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(
        prePostEnabled = true,
        securedEnabled = true,
        jsr250Enabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable();
        http.authorizeRequests()
                .antMatchers("/view/**").permitAll()
                .antMatchers("/form/**", "/bags/**", "/blankets/**", "/hats/**", "/quilts/**").hasAnyAuthority("MAKER", "ADMIN")
                .antMatchers("/admin/**").hasAnyAuthority("ADMIN")
                .anyRequest().authenticated()
                .and()
                .formLogin().permitAll()
                .and()
                .logout().permitAll();
    }

So, in the quilt controller, I am trying to specify who can use which methods:

@RestController
@RequestMapping("/quilts")
public class QuiltController {

    private final QuiltService quiltService;
    private final DefaultFileService fileService;

    public QuiltController(QuiltService quiltService,
                           DefaultFileService fileService) {
        this.quiltService = quiltService;
        this.fileService = fileService;
    }

    @PreAuthorize("hasRole('ROLE_MAKER')")
    @GetMapping(path = "/remove")
    public Iterable getAllNotMarkedForDeletion() {
        return quiltService.findAllNotMarkedForDeletion();
    }

    @PostMapping(path = "/create", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
    public BigInteger create(@RequestParam(value = "data") String data,
                             @RequestParam(value = "image") MultipartFile image) throws IOException {
      // does stuff
    }

These methods should both be accessible to MAKER but not ADMIN. The second one is currently accessible to both, which makes sense given the current set up. The first one, however, has the @PreAuthorize annotation which I expected to allow MAKER but block ADMIN. It currently blocks both types of user and I haven't found anything to suggest what I might have missed.

I have tried other annotations instead, but all with the same result:

@PreAuthorize("hasRole('MAKER')")
@RolesAllowed("ROLE_MAKER")
@Secured("ROLE_MAKER")

Help would be most appreciated!

Method level access controls with Spring Boot

0 Answers