Implementing Hierarchical Roles in Spring Security -

i trying implement hierarchical roles in spring security , added following configuration in xml files per spring source documentation.

<bean id="rolehierarchy" class="org.springframework.security.access.hierarchicalroles.rolehierarchyimpl">     <property name="hierarchy">         <value>             role_admin > role_pro             role_pro > role_premium             role_premium > role_basic             role_basic > role_anonymous         </value>     </property> </bean>   <bean id="rolevoter"         class="org.springframework.security.access.vote.rolehierarchyvoter">          <constructor-arg ref="rolehierarchy"/> </bean> 

i have tried above lines getting access denial while role_admin trying access url assigned role_basic. need add more this. found nothing other lines in spring site. also, if know of implementation of hierarchical roles, please mention them.

i think need register rolevoter @ accessdecisionmanager. @see this answer example.

---

but honest, doubt spring hierarchical voter concept, because need add special hierarchical voter everywhere. prefer other way: have implemented custom jdbcdaoimpl overrides addcustomauthorities , add "normal" roles "existing" once.

/**  * extension of {@link jdbcdaoimpl} user detail provider, uses  * {@link privilegesservice} extend provided authorities.  *  */ public class jdbcdaoprivilegesimpl extends jdbcdaoimpl {      private privilegesservice privilegesservice;      public jdbcdaoprivilegesimpl(final privilegesservice privilegesservice) {                 this.privilegesservice = privilegesservice;     }      @override     protected void addcustomauthorities(string username, list<grantedauthority> authorities) {         super.addcustomauthorities(username, authorities);                   list<grantedauthority> privileges = new arraylist<grantedauthority>();         (grantedauthority role : authorities) {             privileges.addall(privilegesservice.getprivilegesforrole(role));         }         authorities.addall(privileges);         } }   public interface privilegesservice {       collection<? extends grantedauthority> getprivilegesforrole(grantedauthority role); }   public class propertyprivilegesserviceimpl implements privilegesservice {      /**      * property bases mapping of roles privileges.      * every role 1 line, privileges comma separated.      */     private properties roletoprivileges;      public propertyprivilegesserviceimpl(properties roletoprivileges) {         if (roletoprivileges == null) {             throw new illegalargumentexception("roletoprivileges must not null");         }         this.roletoprivileges = roletoprivileges;     }      @override     public collection<? extends grantedauthority> getprivilegesforrole(grantedauthority role) {         if (roletoprivileges == null) {             throw new illegalargumentexception("role must not null");         }          string authority = role.getauthority();         if(authority != null) {             string commaseparatedprivileges = roletoprivileges.getproperty(role.getauthority());             if (commaseparatedprivileges != null) {                 list<grantedauthority> privileges = new arraylist<grantedauthority>();                 for(string privilegename : stringutils.commadelimitedlisttoset(commaseparatedprivileges)) {                     privileges.add(new grantedauthorityimpl(privilegename.trim()));                 }                                 return privileges;             } else {                 return collections.emptylist();             }         } else {             return collections.emptylist();         }     } } 

example config

  <bean id="myuserdetailsservice" class="jdbcdaoforupdatableusernames">     <constructor-arg ref="propertyprivilegesservice"/>     <property name="datasource" ref="datasource"/>     <property name="usersbyusernamequery" value="select login,encryptedpassword,loginenabled user login = ?"/>     <property name="enableauthorities" value="true"/>     <property name="authoritiesbyusernamequery" value="select u.login, r.securityroles user u, user2security_roles r u.login= ? , u.id = r. user_fk;"/> </bean>   <bean id="propertyprivilegesservice" class="propertyprivilegesserviceimpl">     <constructor-arg>         <props>             <prop key="role_admin">                 role_premium,                 role_basic             </prop>             <prop key="role_premium">                 rrole_basic             </prop>         </props>     </constructor-arg> </bean>