PricingLoginStart free
Spring Boot 4 Microservices & REST APIs · 课时

基于角色的访问控制

配置基于角色的授权，为不同用户角色定义细粒度的访问权限。

第 3 / 3 课11 个步骤

基于角色的访问控制 是 CoddyKit 上的免费 Spring Boot 4 Microservices & REST APIs 课时。 这是第 3 节课，共 3 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Spring Boot 4 Microservices & REST APIs 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Spring Boot 4 Microservices & REST APIs 课程共包含 3 节课。

本课时的部分内容尚未翻译，以英文显示。

Intro to Role-Based Access

Role-Based Access Control (RBAC) is a method of restricting system access based on the roles of individual users.

Instead of assigning permissions directly to users, you assign permissions to roles, and then assign roles to users.

  • Simplifies security management.
  • Improves security policy enforcement.
  • Easier to audit and maintain.

Benefits of RBAC

RBAC offers several advantages for securing your applications:

  • Scalability: Easily manage access for many users and resources as your application grows.
  • Flexibility: Roles can be changed or updated without modifying individual user permissions.
  • Compliance: Helps meet regulatory requirements by clearly defining who can do what.

Representing User Roles

In Spring Security, roles are typically represented as simple strings, often prefixed with ROLE_ (e.g., ROLE_ADMIN, ROLE_USER).

It's good practice to define these as constants or enums to avoid typos.

public enum UserRole {
  ADMIN,
  USER
}

Spring Security automatically adds the ROLE_ prefix when you use expressions like hasRole('ADMIN').

public enum UserRole {
  ADMIN,
  USER
}

Basic Security Setup

To enable method-level security and configure users with roles, we set up a SecurityFilterChain bean.

This example defines an in-memory user 'admin' with ROLE_ADMIN and 'user' with ROLE_USER.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true) // Enable @PreAuthorize
public class RbacApplication {

    public static void main(String[] args) {
        SpringApplication.run(RbacApplication.class, args);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(org.springframework.security.config.Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build();
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

@RestController
class PlaceholderController {
    @GetMapping("/")
    public String home() {
        return "Welcome to RBAC Demo!";
    }
}

Applying Role Constraints

Spring Security's @PreAuthorize annotation allows you to define access rules directly on controller methods.

It uses Spring Expression Language (SpEL) to evaluate conditions before a method is executed.

@PreAuthorize("hasRole('ADMIN')")

This ensures only users with the ADMIN role can call the method.

@PreAuthorize("hasRole('ADMIN')")

Exclusive Admin Access

Let's create an endpoint that only users with the ADMIN role can access. If a USER tries to access it, they will get a 403 Forbidden error.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class RbacApplication {

    public static void main(String[] args) {
        SpringApplication.run(RbacApplication.class, args);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(org.springframework.security.config.Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build();
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

@RestController
class AdminController {

    @GetMapping("/admin/dashboard")
    @PreAuthorize("hasRole('ADMIN')")
    public String getAdminDashboard() {
        return "Welcome, Admin! This is your dashboard.";
    }

    @GetMapping("/")
    public String home() {
        return "Welcome to RBAC Demo!";
    }
}

Granting Multiple Roles

Sometimes, an endpoint should be accessible by more than one role. You can use hasAnyRole() for this.

For example, a dashboard might be visible to both ADMIN and regular USER roles.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class RbacApplication {

    public static void main(String[] args) {
        SpringApplication.run(RbacApplication.class, args);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic(org.springframework.security.config.Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("password")
            .roles("ADMIN")
            .build();
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(admin, user);
    }
}

@RestController
class MultiRoleController {

    @GetMapping("/dashboard")
    @PreAuthorize("hasAnyRole('ADMIN', 'USER')")
    public String getUserDashboard() {
        return "Hello! Welcome to your dashboard.";
    }

    @GetMapping("/admin/settings")
    @PreAuthorize("hasRole('ADMIN')")
    public String getAdminSettings() {
        return "Admin settings page.";
    }

    @GetMapping("/")
    public String home() {
        return "Welcome to RBAC Demo!";
    }
}

Custom Access Decisions

While hasRole() and hasAnyRole() cover many cases, Spring Security allows more complex access rules.

You can use SpEL to check multiple conditions, like hasRole('ADMIN') and hasIpAddress('192.168.1.0/24').

For very complex or dynamic logic, you can implement custom PermissionEvaluator beans.

Testing Your RBAC

You can test your RBAC configuration by running your Spring Boot application and using a tool like Postman or curl:

  • Log in as 'admin' (user: admin, pass: password) and try to access all endpoints.
  • Log in as 'user' (user: user, pass: password) and verify access to user endpoints, but not admin-only ones.
  • Try without authentication to see if it's rejected.

RBAC Access Check

Consider the following Spring Security configuration and controller method:

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
// ... other config ...

@Bean
public UserDetailsService userDetailsService() {
    UserDetails userA = User.withDefaultPasswordEncoder()
        .username("alice").password("pw").roles("USER").build();
    UserDetails userB = User.withDefaultPasswordEncoder()
        .username("bob").password("pw").roles("MANAGER").build();
    return new InMemoryUserDetailsManager(userA, userB);
}

@RestController
class MyController {
    @GetMapping("/report")
    @PreAuthorize("hasAnyRole('USER', 'ADMIN')")
    public String getReport() {
        return "Confidential Report";
    }
}

Which user(s) can successfully access the /report endpoint?

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
// ... other config ...

@Bean
public UserDetailsService userDetailsService() {
    UserDetails userA = User.withDefaultPasswordEncoder()
        .username("alice").password("pw").roles("USER").build();
    UserDetails userB = User.withDefaultPasswordEncoder()
        .username("bob").password("pw").roles("MANAGER").build();
    return new InMemoryUserDetailsManager(userA, userB);
}

@RestController
class MyController {
    @GetMapping("/report")
    @PreAuthorize("hasAnyRole('USER', 'ADMIN')")
    public String getReport() {
        return "Confidential Report";
    }
}
在交互式课程中回答

RBAC Lesson Summary

In this lesson, we explored Role-Based Access Control (RBAC) in Spring Boot Microservices.

  • We learned how to define and assign roles to users.
  • We configured Spring Security to recognize these roles using SecurityFilterChain.
  • We used @PreAuthorize with hasRole() and hasAnyRole() to secure API endpoints based on user roles.

RBAC is a powerful way to manage access control efficiently and securely in your applications.

免费开始

用 AI 导师学习 Java — 免费

在浏览器中编写并运行真实代码，获得全天候 AI 导师的即时帮助，并在网页或应用中继续学习。

课程
24
课程
93
免费开始学习查看完整课程

常见问题解答

「基于角色的访问控制」课时是免费的吗？

是的 — 「基于角色的访问控制」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Spring Boot 4 Microservices & REST APIs 课程的其余内容，请升级到 CoddyKit PRO。 Spring Boot 4 Microservices & REST APIs 课程共包含 3 节课。

「基于角色的访问控制」这节课中我会学到什么？

配置基于角色的授权，为不同用户角色定义细粒度的访问权限。 你通过在浏览器中直接运行的动手代码来练习 Spring Boot 4 Microservices & REST APIs，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Spring Boot 4 Microservices & REST APIs 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Spring Boot 4 Microservices & REST APIs 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 3 节课，共 3 节。

「基于角色的访问控制」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Spring Boot 4 Microservices & REST APIs 课中编写并运行代码吗？

能。每节 Spring Boot 4 Microservices & REST APIs 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. OAuth2 与 JWT 基础
  2. 保护 REST 端点
  3. 基于角色的访问控制
← 返回 Spring Boot 4 Microservices & REST APIs