Question

I am new to Spring Security. Can Spring Security validate the relationship between users?

for example:

I have two users type. one is teacher, another one is student.
I wanna validate whether this student have relationship with the special teacher.
Then the student can do some operation with this special teacher.
Can spring security achieve this goal?

Please provide me some reference, keyword, or link then i can do more study

Thx

Answer 1

Security issues can be categorised as authentication or authorization issues. Your issue is an authorization issue. But it is not a static authorization problem, since it is not caused due to the configuration of rights and roles of the user, but it is a dynamic one since it has to do with the student being related to a teacher in order to be authorised to execute some specific action. What you need is to inject the spring security which business checks that provide a positive flag each time this relation is satisfied.

If I undestood you problem well perhaps you might need to read and understand about AccessDecisionManager class from Spring Security.