blocks|key|2349615|text|对于授权，也可以有以下两种方式：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2349616|OAuth+(参考文献-+https://medium.com/@bvulaj/mapping-your-users-and-roles-with-spring-boot-oauth2-a7ac3bbe8e7f)|ordered-list-item|offset|length|2349617|Spring安全角色和特权(参考-+https://www.baeldung.com/role-and-privilege-for-spring-security-registration)|2349618|entityMap|0|LINK|mutability|MUTABLE|url|https://medium.com/@bvulaj/mapping-your-users-and-roles-with-spring-boot-oauth2-a7ac3bbe8e7f|1|https://www.baeldung.com/role-and-privilege-for-spring-security-registration^0|0|D|2K|0|0|I|24|1|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@$E|U|F|V|1|W]]|A|$]]|$1|G|3|H|5|D|7|X|8|@]|9|@$E|Y|F|Z|1|10]]|A|$]]|$1|I|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|J|$K|$5|L|M|N|A|$O|P]]|Q|$5|L|M|N|A|$O|R]]]]

For authorization, there can be these two ways as well:
<ol>
<li>OAuth (Reference - <a href="https://medium.com/@bvulaj/mapping-your-users-and-roles-with-spring-boot-oauth2-a7ac3bbe8e7f" rel="nofollow noreferrer">https://medium.com/@bvulaj/mapping-your-users-and-roles-with-spring-boot-oauth2-a7ac3bbe8e7f</a>)</li>
<li>Spring Security Roles and Privileges(Reference- <a href="https://www.baeldung.com/role-and-privilege-for-spring-security-registration" rel="nofollow noreferrer">https://www.baeldung.com/role-and-privilege-for-spring-security-registration</a>)</li>
</ol>

blocks|key|1786147|text|如果您正在使用Security，您可以使用方法安全注释(如@PreAuthorize、@PostAuthorize+)来处理它。甚至将它们合并到新的注释中。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1786148|首先，您的用户需要实现UserDetails，然后您应该根据您的角色和权限结构实现getAuthorities()方法--+Security基本上检查getAuthority()方法返回的是什么，如果返回的值以"ROLE_"+(如"ROLE_ADMIN"+)作为前缀，则将作为角色处理，如果它没有以"ROLE_“作为前缀，它将作为权限进行处理，您可以使用方法注释来检查权限和角色，如下例所示：|1786149|@PreAuthorize("hasRole('ROLE_ADMIN')+and+hasAuthority("READ")")+|code-block|syntax|javascript|1786150|+Security将通过用户的getAuthorities()实现来检查您的授权，然后根据您的注释，它将由Security+代表您自动检查。|BOLD|1786151|为了清晰起见，您可以检查https://www.baeldung.com/spring-security-granted-authority-vs-role|1786152|为了快速实现，您可以查看下面的文章(我不会直接使用它，但您可以理解这个想法。此外，您还可以使用权限，但简单的解决方案可能是下面的解决方案。)：|1786153|https://www.baeldung.com/role-and-privilege-for-spring-security-registration|1786154|entityMap|0|LINK|mutability|MUTABLE|url|https://www.baeldung.com/spring-security-granted-authority-vs-role|1^0|T|D|17|E|0|15|G|2X|7|37|C|0|0|0|9|1Q|8|F|G|0|0|26|C|1U|0|0|0|1Z|0|0|24|0|24|1|0^^$0|@$1|2|3|4|5|6|7|14|8|@$9|15|A|16|B|C]|$9|17|A|18|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|19|8|@$9|1A|A|1B|B|C]|$9|1C|A|1D|B|C]|$9|1E|A|1F|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|1G|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1H|8|@$9|1I|A|1J|B|O]|$9|1K|A|1L|B|O]|$9|1M|A|1N|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|6|7|1O|8|@$9|1P|A|1Q|B|O]]|D|@$9|1R|A|1S|1|1T]]|E|$]]|$1|R|3|S|5|6|7|1U|8|@$9|1V|A|1W|B|O]]|D|@]|E|$]]|$1|T|3|U|5|6|7|1X|8|@$9|1Y|A|1Z|B|O]]|D|@$9|20|A|21|1|22]]|E|$]]|$1|V|3|-4|5|6|7|23|8|@]|D|@]|E|$]]]|W|$X|$5|Y|Z|10|E|$11|12]]|13|$5|Y|Z|10|E|$11|U]]]]

If you are using Spring Security you can handle it with method security annotations like <code>@PreAuthorize</code>, <code>@PostAuthorize</code> .. even combine them to new annotations.
First your User need to implements UserDetails then you should implement <code>getAuthorities()</code> method according to your Role and Authority structure Spring Security basically checks what getAuthority() method returns if returned value prefixed with <code>&quot;ROLE_&quot;</code> like <code>&quot;ROLE_ADMIN&quot;</code> it will be processed as ROLE if it does not prefixed with &quot;ROLE_&quot; it will be processed as Authority
you can use method annotation for checking authority and role like following example:
<pre><code>@PreAuthorize(&quot;hasRole('ROLE_ADMIN') and hasAuthority(&quot;READ&quot;)&quot;) 
</code></pre>
and Spring Security will check your granted Authorities by <code>getAuthorities()</code> implementation of your User then, according to your annotation it will be checked automatically by Spring Security behalf of you.
For clarity you can check
<a href="https://www.baeldung.com/spring-security-granted-authority-vs-role" rel="nofollow noreferrer">https://www.baeldung.com/spring-security-granted-authority-vs-role</a>
For quick working implementation you can check article below(I would not directly use it but you can understand the idea. Also you can use permissions but simple solution probably the solution below.):
<a href="https://www.baeldung.com/role-and-privilege-for-spring-security-registration" rel="nofollow noreferrer">https://www.baeldung.com/role-and-privilege-for-spring-security-registration</a>

blocks|key|1786220|text|您可以创建一个自定义注释来处理每个角色的请求。关于如何实现的更多细节，我可以阅读这个文章。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1786221|在api中将有格式：|1786222|@GetMapping(...)
@YouCustomAnnotation("roleName")
public+void+doSomeThing(){
}|code-block|syntax|javascript|1786223|如果用户的角色与注释中的角色定义相匹配，则调用此api；如果用户的角色不匹配，服务器将返回404代码。|1786224|entityMap|0|LINK|mutability|MUTABLE|url|https://laptrinhx.com/implementation-of-interface-version-support-for-back-end-in-spring-boot-application-2064884813/^0|16|2|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|Z|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|10|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]]]

You can create a custom annotation to handle request for each role. I you can read this <a href="https://laptrinhx.com/implementation-of-interface-version-support-for-back-end-in-spring-boot-application-2064884813/" rel="nofollow noreferrer">article</a> for more details about how to implement.
And in api will have format:
<pre><code>@GetMapping(...)
@YouCustomAnnotation(&quot;roleName&quot;)
public void doSomeThing(){
}
</code></pre>
This api will be called if role of user matched with role define in annotation and server will return 404 code if user's role not match.

I am new to Spring boot. I need to implement role based authorization in spring boot. I am having different roles and multiple users will be mapped to each role. I will be setting different access (read, add, delete, edit)
Whenever an api gets called, need to check the access and allow permission.
I am planning to use interceptor to call method having the query to get the access from DB and deny or access the api.
Is there any other better way I can use for the same?

Role based authorization in spring boot

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我对春靴很陌生。我需要在spring引导中实现基于角色的授权。我有不同的角色，多个用户将映射到每个角色。每当调用api时，我将设置不同的访问(读取、添加、删除、编辑)，需要检查访问权限和允许权限。我计划使用拦截器调用方法，让查询从DB获得访问权，并拒绝或访问api。还有其他更好的方法可以用来做同样的事情吗？

问spring引导中基于角色的授权
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问spring引导中基于角色的授权EN