defining custom authorities...

[briankuhn]

This is probably a newbie question, but I can't seem to figure out how to define my own names for granted authorities. In the following bean definition, where does the role name ROLE_USER come from? Is there a predefined list of possible roles somewhere? I tried replacing it with just 'user', but my webapp wouldn't even deploy.

Thanks,
Brian Kuhn

<bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
    <property name="authenticationManager"><ref local="authenticationManager"/></property>
    <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
    <property name="objectDefinitionSource">
        <value>
            CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
            PATTERN_TYPE_APACHE_ANT
            /secure/**=ROLE_USER
        </value>
    </property>
</bean>

[Ben Alex]

Your AuthenticationManager is responsible for defining the Authentication, which includes the GrantedAuthority[]s.

Most people use DaoAuthenticationProvider, which delegates to an AuthenticationDao. The latter populates a UserDetails object (typically User) which contains the granted authorities.

Alternatively, you can use the in-memory AuthenticationDao or the JdbcDaoImpl. The former obtains the granted authorities from the IoC container (as typically defined in the XML file), and the latter from a dedicated database table.

[briankuhn]

Thanks Ben. I think you may have misunderstood my question though. I've implmented my AuthenticationDao, and it works fine. I'm trying to understand why my role names have to be converted to "ROLE_" + role.toUpperCase() as in the following example:

package com.briankuhn.webapp.web.acegisecurity;

import com.briankuhn.webapp.data.value.Account;
import com.briankuhn.webapp.data.access.AccountDAO;
import ...

public class AccountAuthenticationDAO implements AuthenticationDao {
    
    private AccountDAO accountDAO = null;
    
    public void setAccountDAO(AccountDAO accountDAO) {
        this.accountDAO = accountDAO;
    }
    
    public UserDetails loadUserByUsername(String username) {
        
        UserDetails userDetails = null;
        if (this.accountDAO != null) {
            
            Account account = this.accountDAO.get(username);
            if (account != null) {
                
                String role = account.getRole();
                if (role == null) {
                    role = "";
                }
                else {
                    role = "ROLE_" + role.toUpperCase();
                }
                    
                GrantedAuthority[] authorities =        
                        new GrantedAuthority[] {new GrantedAuthorityImpl(role)};    
                        
                userDetails = new User(account.getEmailAddress(),
                                       account.getPassword(),
                                       true,
                                       authorities);
            }
        }
        
        return userDetails;
    }
}

I'd rather use the roles already defined in my db (admin/user) and have a filterInvocationInterceptor configuration like this:

<bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
    <property name="authenticationManager"><ref local="authenticationManager"/></property>
    <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
    <property name="objectDefinitionSource">
        <value>
            CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
            PATTERN_TYPE_APACHE_ANT
            /secure/admin/**=admin
            /secure/**=user
        </value>
    </property>
</bean>

Am I missing the point?

[Ben Alex]

Typically an AccessDecisionVoter will look for specific configuration attributes, so it knows when to fire. Thus if you've got a RoleVoter and say a BasicAclEntryVoter, both won't vote on exactly the same access decision.

By default RoleVoter only votes on configuration attributes starting with ROLE_ (case sensitive). You can call its setRolePrefix(String rolePrefix) method with an empty String to cause it to vote on every configuration attribute, thus matching your database. Although if it were me I'd probably change my AuthenticationDao to prepend ROLE_ to each GrantedAuthority, thus allowing different voters to distinguish and retaining the default behaviour and configuration of the security framework as much as possible.