How @RoleAllowed handle higer privilege roles internally

[Abhra Kar]

Hi ,
          In my project @RolesAllowed is used as @RolesAllowed({ "EMPLOYEE }) for methods.But those methods also can be used with higher privilege roles like ADMIN, HR. In an enum roles are declared as ---

enum Role {
        ADMIN("ADMIN", 3),
        HR("HR", 2),
        EMPLOYEE("EMPLOYEE", 1);
:::::::::::::::::::::::::::::::::::::::::::::

}

It's a web project and sping core is used here.
What can be the possible ways these roles are applied internally for those methods?
Thanks

[Tim Holloway]

I think that this is more of a Spring question than Java in General.

I'm not sure what Spring is providing, but the JEE standard roles don't have "higher" and "lower" privileges. You either have a role or you don't, and if you have at least one of the roles permitted for the resource, you can access the resource, otherwise you cannot (logical "OR" relationship).

But I'll post this to the Spring forum where they can give you information more specific to Spring.

[Abhra Kar]

Thanks a lot Tim, please provide the link posted in spring community so I can follow up.
Regards,
Abhra

[Tim Holloway]

Abhra Kar wrote:Thanks a lot Tim, please provide the link posted in spring community so I can follow up.
Regards,
Abhra

I've already cross-linked it, so you don't need to do anything.