Question

How to make a link visible only if an authenticated user has correspondent permissions?

I’m using JSF, and as I understand, I should use rendered attribute of a component which should call backing bean’s boolean method.

I’ve even found correspondent code some time ago but now I can’t find it again. So, can anyone give me an example of such boolean method which works with spring security? (or, even better, link to some article which describes this issue).

Answer 1

We use the SecurityContextHolder to access the currently logged in user. We then use the users getAuthorities() method to get her roles, resulting in (roughly) the following:

((UserDetails)SecurityContextHolder.getPrincipal()).getAuthorities();