Roles, authorities, permissions
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
model who may do what.
Planned topics
- An authority is one permission string, such as
ORDER_READ. - A role is a named group of permissions, such as
ADMIN; in Spring a role is an authority with theROLE_prefix. - RBAC (role-based access control): assign roles to users, and check roles.
- Keep roles few and meaningful (customer, admin); add finer permissions only when needed.
- A role says what kind of action is allowed, not which records.
Draft outline details
Demonstration
a table: role / authorities / example endpoints.
Check your understanding
Does a role decide which orders a customer can see?
Show answer
No. That needs an ownership check.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.