0Pricing
Spring Boot 4 Microservices & REST APIs · 강의

역할 기반 접근 제어

사용자 역할마다 세분화된 접근 권한을 정의하도록 역할 기반 인증을 구성합니다.

역할 기반 접근 제어은(는) CoddyKit의 무료 Spring Boot 4 Microservices & REST APIs 강의입니다. 이것은 3개 중 3번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 Spring Boot 4 Microservices & REST APIs 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. Spring Boot 4 Microservices & REST APIs 강의에는 총 3개의 강의가 포함되어 있습니다.

이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.

Intro to Role-Based Access

Role-Based Access Control (RBAC) is a method of restricting system access based on the roles of individual users.

Instead of assigning permissions directly to users, you assign permissions to roles, and then assign roles to users.

  • Simplifies security management.
  • Improves security policy enforcement.
  • Easier to audit and maintain.

Benefits of RBAC

RBAC offers several advantages for securing your applications:

  • Scalability: Easily manage access for many users and resources as your application grows.
  • Flexibility: Roles can be changed or updated without modifying individual user permissions.
  • Compliance: Helps meet regulatory requirements by clearly defining who can do what.

Representing User Roles

In Spring Security, roles are typically represented as simple strings, often prefixed with ROLE_ (e.g., ROLE_ADMIN, ROLE_USER).

It's good practice to define these as constants or enums to avoid typos.

public enum UserRole {
  ADMIN,
  USER
}

Spring Security automatically adds the ROLE_ prefix when you use expressions like hasRole('ADMIN').

public enum UserRole {
  ADMIN,
  USER
}

Basic Security Setup

To enable method-level security and configure users with roles, we set up a SecurityFilterChain bean.

This example defines an in-memory user 'admin' with ROLE_ADMIN and 'user' with ROLE_USER.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true) // Enable @PreAuthorize
public class RbacApplication {

    public static void main(String[] args) {
        SpringApplication.run(RbacApplication.class, args);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(org.springframework.security.config.Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build();
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

@RestController
class PlaceholderController {
    @GetMapping("/")
    public String home() {
        return "Welcome to RBAC Demo!";
    }
}

Applying Role Constraints

Spring Security's @PreAuthorize annotation allows you to define access rules directly on controller methods.

It uses Spring Expression Language (SpEL) to evaluate conditions before a method is executed.

@PreAuthorize("hasRole('ADMIN')")

This ensures only users with the ADMIN role can call the method.

@PreAuthorize("hasRole('ADMIN')")

Exclusive Admin Access

Let's create an endpoint that only users with the ADMIN role can access. If a USER tries to access it, they will get a 403 Forbidden error.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class RbacApplication {

    public static void main(String[] args) {
        SpringApplication.run(RbacApplication.class, args);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(org.springframework.security.config.Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build();
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

@RestController
class AdminController {

    @GetMapping("/admin/dashboard")
    @PreAuthorize("hasRole('ADMIN')")
    public String getAdminDashboard() {
        return "Welcome, Admin! This is your dashboard.";
    }

    @GetMapping("/")
    public String home() {
        return "Welcome to RBAC Demo!";
    }
}

Granting Multiple Roles

Sometimes, an endpoint should be accessible by more than one role. You can use hasAnyRole() for this.

For example, a dashboard might be visible to both ADMIN and regular USER roles.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class RbacApplication {

    public static void main(String[] args) {
        SpringApplication.run(RbacApplication.class, args);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(org.springframework.security.config.Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build();
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

@RestController
class MultiRoleController {

    @GetMapping("/dashboard")
    @PreAuthorize("hasAnyRole('ADMIN', 'USER')")
    public String getUserDashboard() {
        return "Hello! Welcome to your dashboard.";
    }

    @GetMapping("/admin/settings")
    @PreAuthorize("hasRole('ADMIN')")
    public String getAdminSettings() {
        return "Admin settings page.";
    }

    @GetMapping("/")
    public String home() {
        return "Welcome to RBAC Demo!";
    }
}

Custom Access Decisions

While hasRole() and hasAnyRole() cover many cases, Spring Security allows more complex access rules.

You can use SpEL to check multiple conditions, like hasRole('ADMIN') and hasIpAddress('192.168.1.0/24').

For very complex or dynamic logic, you can implement custom PermissionEvaluator beans.

Testing Your RBAC

You can test your RBAC configuration by running your Spring Boot application and using a tool like Postman or curl:

  • Log in as 'admin' (user: admin, pass: password) and try to access all endpoints.
  • Log in as 'user' (user: user, pass: password) and verify access to user endpoints, but not admin-only ones.
  • Try without authentication to see if it's rejected.

RBAC Access Check

Consider the following Spring Security configuration and controller method:

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
// ... other config ...

@Bean
public UserDetailsService userDetailsService() {
    UserDetails userA = User.withDefaultPasswordEncoder()
        .username("alice").password("pw").roles("USER").build();
    UserDetails userB = User.withDefaultPasswordEncoder()
        .username("bob").password("pw").roles("MANAGER").build();
    return new InMemoryUserDetailsManager(userA, userB);
}

@RestController
class MyController {
    @GetMapping("/report")
    @PreAuthorize("hasAnyRole('USER', 'ADMIN')")
    public String getReport() {
        return "Confidential Report";
    }
}

Which user(s) can successfully access the /report endpoint?

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
// ... other config ...

@Bean
public UserDetailsService userDetailsService() {
    UserDetails userA = User.withDefaultPasswordEncoder()
        .username("alice").password("pw").roles("USER").build();
    UserDetails userB = User.withDefaultPasswordEncoder()
        .username("bob").password("pw").roles("MANAGER").build();
    return new InMemoryUserDetailsManager(userA, userB);
}

@RestController
class MyController {
    @GetMapping("/report")
    @PreAuthorize("hasAnyRole('USER', 'ADMIN')")
    public String getReport() {
        return "Confidential Report";
    }
}

RBAC Lesson Summary

In this lesson, we explored Role-Based Access Control (RBAC) in Spring Boot Microservices.

  • We learned how to define and assign roles to users.
  • We configured Spring Security to recognize these roles using SecurityFilterChain.
  • We used @PreAuthorize with hasRole() and hasAnyRole() to secure API endpoints based on user roles.

RBAC is a powerful way to manage access control efficiently and securely in your applications.

자주 묻는 질문

“역할 기반 접근 제어” 강의는 무료인가요?

네 — “역할 기반 접근 제어” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 Spring Boot 4 Microservices & REST APIs 강의 전체를 잠금 해제할 수 있습니다. Spring Boot 4 Microservices & REST APIs 강의에는 총 3개의 강의가 포함되어 있습니다.

“역할 기반 접근 제어”에서 뭘 배우나요?

사용자 역할마다 세분화된 접근 권한을 정의하도록 역할 기반 인증을 구성합니다. 브라우저에서 직접 실행하는 실습 코드로 Spring Boot 4 Microservices & REST APIs을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.

Spring Boot 4 Microservices & REST APIs을(를) 시작하는 데 경험이 필요한가요?

사전 경험은 필요하지 않습니다. CoddyKit의 Spring Boot 4 Microservices & REST APIs은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 3개 중 3번째 강의입니다.

“역할 기반 접근 제어” 강의는 얼마나 걸리나요?

대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.

이 Spring Boot 4 Microservices & REST APIs 강의에서 코드를 작성하고 실행할 수 있나요?

네. 모든 Spring Boot 4 Microservices & REST APIs 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.

이 강의의 모든 강의

  1. OAuth2 및 JWT 기초
  2. REST 엔드포인트 보안
  3. 역할 기반 접근 제어
← Spring Boot 4 Microservices & REST APIs(으)로 돌아가기