Question

I would like to allow access to a particular method to more than one group of users. Is it possible in Spring Security 3.x to do such a thing using the @Secured annotation? Consider two groups (roles) OPERATOR and USER, would this code be valid:

    @Secured("ROLE_OPERATOR", "ROLE_USER")
    public void doWork() {
        // do useful processing
    }

Answer 1

You’re almost there. Syntactically, you need to write it like this:

@Secured({"ROLE_OPERATOR", "ROLE_USER"})
public void doWork() { ... }

This is because you’re supplying multiple values to a single array attribute of the annotation. (Java syntactically special-cases handing in a single value, but now you need to do it “properly”.)