title: spring-security decouple roles and permissions
body: <p>I'm currently working on a <code>spring-boot 2.0</code> <code>REST</code> backend for a web-application. The <code>spring-boot</code> application receives <code>OAuth2</code> AccessTokens for authentication with application specific roles for authorization. Now I want to secure various <code>REST</code> endpoints and methods based on the <code>OAuth2</code> roles. I'm loking for a solution that does not couple my code directly to the roles, <strong>not</strong> like <code>@PreAuthorize("hasRole('ADMIN')")</code>.</p>
  
  <p>In addition to the authorization, the <code>REST</code> endpoints should also return customized results (e.g. if the request contains an valid <code>OAuth2</code> token with the role 'company_A_internal', the response should contain a result-set filtered on 'company_A').</p>
  
  <p><strong>What I've already accomplished so far:</strong></p>
  
  <ol>
  <li>The authentication based on the <code>OAuth2</code> token with the help of the <code>spring-security</code></li>
  <li>The mapping of the <code>OAuth2</code> token roles to the <code>spring-security</code> <code>GrantedAuthorities</code> so that <code>SecurityContextHolder.getContext().getAuthentication().getAuthorities()</code> returns the former roles</li>
  </ol>
  
  <p><strong>What I'm looking for:</strong></p>
  
  <p>Based on the roles (now stored in the <code>GrantedAuthorities</code>) the <code>REST</code> endpoints should be secured by a separate mechanism. I did some research and came across a really interesting <a href="https://dzone.com/articles/simple-secure-role-based-access-control-rbac-for-r" rel="nofollow noreferrer">article</a>.</p>
  
  <p>I would like to implement something similar to this (e.g. as a separate roles_config.yml):</p>
  
  <pre><code>order_manager:
    '/orders':
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
  order_editor:
    '/orders':
      - 'GET'
      - 'POST'
      - 'PUT'
  order_inspector:
    '/orders':
      - 'GET'
  </code></pre>
  
  <p>Afterwards I'd only have to implement something like this in the <code>spring-boot</code> context:</p>
  
  <pre><code>@Secured
  @RequestMapping("/orders")
  public void updateOrder (Order order) {
    Order updatedOrder = process(order);
    return updatedOrder;
  }
  </code></pre>
  
  <p>How will this work in the context of <code>spring-security</code>? Is there any possible way of implementing this on top of my current setup?</p>
  
  <p>I appreciate any kind of recommendations and help and will gladly answer to comments and further questions.</p>