0

I use Spring security so log in on the site I'm building to study Spring. I used Hibernate to map User object to other objects that allow user to see or not pages, according to its role. It works.

I was asking if I can know by using authorities-by-username-query, all the role a single user has, instead of checking my User object. This is my query:

        authorities-by-username-query="select u1.utente, 
        u1.email, u2.descrizione, u3.id_autorizzazioni,
        u3.autorizzazione from autenticazione u1,
        autorizzazione u2, autorizzazioni
        u3 where u1.utente = u3.utente and 
        u2.id_autorizzazione = u3.autorizzazione and u1.email =?"

If I write that query on mysql console I get 3 records, so the query it's right.

This is my database

enter image description here

I used Collection<SimpleGrantedAuthority> authorities = (Collection<SimpleGrantedAuthority>) SecurityContextHolder.getContext().getAuthentication().getAuthorities(); but I always get a collection that have size 1 instead of 3 (I have 3 roles in the db for the user, as you can see in the pic). I don't understand if it depends on my db or my authorities-by-username-query. Probably one of the two things is wrong

4
  • What is your question?
    – Ralph
    Jan 19, 2015 at 9:48
  • How can I know all the rolesof a user
    – MDP
    Jan 19, 2015 at 9:49
  • What role do you get in the 1-size Collection?
    – holmis83
    Jan 19, 2015 at 14:31
  • Thanks everybody. The problem was the authorities-by-username-query query. As second field of the query I should retrieve the ROLES. So far I got just one element, because i was getting the email of the user logged, according to the wrong query I wrote.
    – MDP
    Jan 20, 2015 at 11:17

2 Answers 2

2

You can use SecurityContextHolder.getContext().getAuthentication().getAuthorities() to obtain a collection of the currently logged in user's roles.

Collection<SimpleGrantedAuthority> authorities = (Collection<SimpleGrantedAuthority>)    SecurityContextHolder.getContext().getAuthentication().getAuthorities();

You have the collection of roles in the authorities variable.

Little bit more excercise

private boolean hasRole(String role) {
  Collection<GrantedAuthority> authorities = (Collection<GrantedAuthority>)
  SecurityContextHolder.getContext().getAuthentication().getAuthorities();
  boolean hasRole = false;
  for (GrantedAuthority authority : authorities) {
     hasRole = authority.getAuthority().equals(role);
     if (hasRole) {
      break;
     }
  }
  return hasRole;
}
2
  • I've already tried using it, but i always get a collection that have size 1 instead of 3 (i have 3 roles in the db for the user). I don't understand if it depends on my db or my query. Probably one of the two things is wrong
    – MDP
    Jan 19, 2015 at 9:59
  • Thanks everybody. The problem was the authorities-by-username-query query. As second field of the query I should retrieve the ROLES. So far I got just one element, because i was getting the email of the user logged, according to the wrong query I wrote.
    – MDP
    Jan 20, 2015 at 11:21
0

You can use two different approaches:

  • query for the user roles (of any user) in the database
  • "look" in the Session to get the roles of the current user

For the first approach it is possible to invoke the UserDetailsService.loadUserByUsername(String username) method.

For the second approach: SecurityContextHolder.getContext().getAuthentication().getAuthorities();

3
  • I don't want to make another query, i'm wondering if I can use "authorities-by-username-query". What you mean with "look in the Session"?. I'm able to know the username, but I couldn't find a way to know the list of the roles
    – MDP
    Jan 19, 2015 at 9:51
  • UserDetailsService.loadUserByUsername reuse the query!
    – Ralph
    Jan 19, 2015 at 15:39
  • Thanks everybody. The problem was the authorities-by-username-query query. As second field of the query I should retrieve the ROLES. So far I got just one element, because i was getting the email of the user logged, according to the wrong query I wrote.
    – MDP
    Jan 20, 2015 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.