Adding or Changing Role Prefix

Spring Security allows you to specify a role prefix in its configuration. Where the role prefix is used in the configuration varies according to your security back-end. There are modifications that will need to be completed regardless of security back-end. Those are covered first. The remaining sections cover specific security back-ends and should be used where applicable. In the examples that follow, MY_ROLE_PREFIX_ is the prefix that will be used.

For All Security Back-ends

In order for RoleVoter to determine if it "supports" a particular type of decision, it references its rolePrefix property. Be sure to set this to your prefix or use value="" if no prefix is used.

applicationContext-common-authorization.xml

<bean id="roleVoter" class="org.springframework.security.vote.RoleVoter">
  <property name="rolePrefix" value="MY_ROLE_PREFIX_" />
</bean>

Roles are referenced by name in pentaho.xml.

pentaho.xml

<acl-publisher>
  <default-acls>
    <acl-entry role="MY_ROLE_PREFIX_Admin" acl="ADMIN_ALL" />
    <acl-entry role="MY_ROLE_PREFIX_cto" acl="ADMIN_ALL" />
    <acl-entry role="MY_ROLE_PREFIX_dev" acl="EXECUTE_SUBSCRIBE" />
    <acl-entry role="MY_ROLE_PREFIX_Authenticated" acl="EXECUTE" />
  </default-acls>
</acl-publisher>

<acl-voter>
  <admin-role>MY_ROLE_PREFIX_Admin</admin-role>
</acl-voter>

<anonymous-authentication>
  <anonymous-user>anonymousUser</anonymous-user>
  <anonymous-role>MY_ROLE_PREFIX_Anonymous</anonymous-role>
</anonymous-authentication>

Again, roles are referenced by name when allowing anonymous users and when specifying authorization rules for URLs.

applicationContext-spring-security.xml

<bean id="anonymousProcessingFilter" class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
  <property name="key" value="foobar" />
  <property name="userAttribute" value="anonymousUser,MY_ROLE_PREFIX_Anonymous" />
</bean>

<bean id="filterInvocationInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">

  <!-- omitted -->

  <property name="objectDefinitionSource">
    <value>
    <![CDATA[
    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    \A/login.*\Z=MY_ROLE_PREFIX_Anonymous,MY_ROLE_PREFIX_Authenticated

    ...omitted...

    /\A/.*\Z=MY_ROLE_PREFIX_Authenticated
    ]]>
    </value>
  </property>
</bean>

Memory

This type of security back-end specifies role names in Spring XML files.

applicationContext-spring-security-memory.xml

<bean id="userMap" class="java.lang.String">
  <constructor-arg type="java.lang.String">
    <value>
    <![CDATA[
    joe=password,MY_ROLE_PREFIX_ceo,MY_ROLE_PREFIX_Admin,MY_ROLE_PREFIX_User,MY_ROLE_PREFIX_Authenticated

    ...omitted...

    </value>
  </constructor>
</bean>

applicationContext-pentaho-security-memory.xml

<bean id="inMemoryUserRoleListService" class="org.pentaho.platform.plugin.services.security.userrole.memory.InMemoryUserRoleListService">

<!-- omitted -->

  <property name="allAuthorities">
    <list>
      <bean class="org.springframework.security.GrantedAuthorityImpl">
        <constructor-arg value="MY_ROLE_PREFIX_Authenticated" />
      </bean>

      <!-- omitted -->

    </list>
  </property>

  <!-- omitted -->

</bean>

Relational Database (JDBC)

There is no additional configuration required to use role prefixes. However, be sure that your roles are stored in your database with the prefixes! In other words, assuming your role names are stored in the ROLE column of the ROLES table, if you executed a SELECT ROLE FROM ROLES, you would see:

ROLE
MY_ROLE_PREFIX_Authenticated
MY_ROLE_PREFIX_ceo
...omitted...

Directory (LDAP)

The configuration below assumes that your role entries are NOT stored with the prefix. The prefixes are added when the roles are fetched.

applicationContext-spring-security-ldap.xml

<bean id="populator" class="org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator">

  <!-- omitted -->

  <property name="rolePrefix" value="MY_ROLE_PREFIX_" />

  <!-- omitted -->

</bean>

applicationContext-pentaho-security-ldap.xml

<bean id="allAuthoritiesSearch"
 class="org.pentaho.platform.plugin.services.security.userrole.ldap.search.GenericLdapSearch">

  <!-- omitted -->
  
  <constructor-arg index="2">
    <bean class="org.apache.commons.collections.functors.ChainedTransformer">
      <constructor-arg index="0">
        <list>

          <!-- omitted -->
          
          <bean class="org.pentaho.platform.plugin.services.security.userrole.ldap.transform.StringToGrantedAuthority">
            <property name="rolePrefix" value="MY_ROLE_PREFIX_" />

            <!-- omitted -->

          </bean>
        </list>
      </constructor-arg>
    </bean>
  </constructor-arg>
</bean>