We Keep Coding

How to logout user when update role with Spring Security

I am working on an application with several roles. Changing this role to admin user should log out the target user.
My first lead was to set up data tables to retrieve the list of active tokens by taking an example from this site:
https://javadeveloperzone.com/spring-boot/spring-boot-oauth2-jdbc-token-store-example/#3_Source_Code
Except that at the connection, the data information is not saved in my tables.
Is it possible to log out a user "by force"?

Yes, there are several ways how you do it.
At the end of the day it invalidates the Authentication object in Spring's security context.

Spring Security - How to change user roles dynamically?

I have a question about changing role dynamically in runtime. Suppose that we have a social network application (like Facebook) and we are using Spring security for authentication/authorization purpose.
When a person open his Homepage this person has the ADMIN role and can do everything with his Homepage. However, when he is visiting another friend's Homepage he should only have the role USER which can only do some restricted actions (he cannot delete posts in the Homepage of his friend, for example).
If we use AuthenticationManagerBuilder then we can only set one fixed role for each user.
Can anyone help me with this question?
Thank you.

I think you should overthink your concept. Users are always users.
Users with homepages are userWithHomepage
and real admins are admins.
You need to check on the page, whether the currentUser is privileged for the current page - and give him his roles on this site.
So "UserWithHomepage" comes to his own Homepage, you check: is this user privileged on this site? If yes: activate admin things on this site. If you add a role to his userContext, he could get access as this role to other sites, too. I think, this is a security flaw.
So simply set a marker on your controller or check each time, something happens (instantiation, button click etc.) if the user has the privilege to do so.

You shouldn't change your user roles based on what page they are visiting. In your case, when visiting the homepage, you should check if the user is the owner of the homepage, and if so, give him the option to edit/delete and if not, just don't give them the option (don't show the links for editing/deletion, throw an exception if they try to execute that request anyway).

Thanks all, actually checking if the user is the owner of the Homepage is exactly what we need to do!

Show different web pages and elements depending on the user Role and Privilege

I have a Spring MVC web application with Thymeleaf as the template engine and Spring Security to manage the login phase.
My users can login with different Roles (ROLE_ADMIN, ROLE_USER and ROLE_GUEST).
Moreover a user with Role ROLE_USER is part of one or more Workgroups (a set of users) and in the Workgroup he/she can act with different Privileges: WG_ADMIN, WG_USER, WG_GUEST.
Every Privilege allows the WG user to do some actions over the WG resources.
Now I have a set of views and would like to manage the authorization to the pages and elements of the pages depending on the user's Role and WG Privilege.
What is the canonical way to make things done with Spring MVC and Thymeleaf?
Thank you

You would require a combination of #PreAuthorize and #Secured. I will tell what is the difference. Your controller methods should be annotated with #PreAuthorize. With this, if the user does not have ROLE, user is redirected based upon your security settings.
And with #Secured, if the user does not have the ROLE, that method is not executed. So you should use #Secured in service layers.
Something like this you would required.
#PreAuthorize(hasRole('ROLE_ADMIN'||'ROLE_USER'))
#RequesMapping(value="/doblahblah")
public String doBlahBlahh(){
methodOnlyAdminCanExecute();
methodOnlyUserCanExecute();
}
#PreAuthorize(hasRole('ROLE_USER'))
#RequesMapping(value="/douserstuff")
public String douserstuff(){
methodOnlyAdminCanExecute();
methodOnlyUserCanExecute();
}
Service layer :
public class adminCode{
#Secured("ROLE_ADMIN")
public void doAdminStuff(){
//dostuff
}
}
Now, even if in the 2nd controller method, this method is called, it wont execute, the #Secured annotation will be processed, and that method wont execute.
This is what I understood from your question. If this is not what you are looking for, I will delete my answer.

You can use the following:
<div sec:authorize="hasRole('ROLE_ADMIN')">
Hi, <span sec:authentication="principal.name"></span>
</div>

Spring Security: Different authentication methods depending on entity

first post here, hope im doing right.
In a project, we have a scenario where we have a single web application with multiple entities. Currently, the login is managed via default JDBC Spring Security provider, working fine.
For a new requirement, we need that each entity can have their own login method (currently 2 methods would be available, the JDBC one, which is the current one, and the second method would be authentication via SAML, with each entity defining their own IdP, but this is another story)
I need some guidelines on how this can be achieved, I have done some search and I have found providers for different URL's, etc... But not different login methods for the same app and url's depending on the user type or entity.
Is a good approach to have a custom single entry point where we can check the entity user and then use the suitable authentication provider?
Kind regards,
Alex

As each of your users might be using a different IDP you will in any case need to determine the username before proceeding with initialization of the authentication process - but you already know this.
One approach to take (similar to what Microsoft is using with the Office 365 for corporate users) is:
display a login page with fields for standard username + password
once user enters username and blurs the input field, you make an AJAX call (to your custom API made for this purpose) and fetch information about authentication type + IDP to use for this user
in case the type is password you simply let user continue with filling in the password field and POST to the same place as you're used to for processing with the JDBC provider
in case the type is federated authentication you initialize authentication with the correct IDP by redirecting to /saml/login?idp=xyz and continue with the SAML flow
It's possible to avoid any APIs by submitting the form once user enters the username, or let user click a "Continue" button. It would then make sense to use a custom EntryPoint which:
redirects user to the main login page in case it wasn't provided with a username
displays either login page with username/password or redirects to the correct IDP, once username was provided

Page or Screen Authorization in Alfresco

Is it possible to allow users to access a specific page in Alfresco Share? Which user or user group can access to which page for example.

Not really, unless you can map your users to the fixed set of (site independent) roles (none, guest, user, admin) baked into spring surf.
These roles are wired into various classes (i.e. org.springframework.extensions.surf.mvc.PageView,org.springframework.extensions.webscripts.connector.User,org.springframework.extensions.webscripts.Description).
If you can map your users to these roles, just set the authentication value accordingly in the pages xml descriptor.
For example:
To see the document-library, share requires you to be logged in, and hence, in site-data/pages/documentlibrary.xml it reads <authentication>user</authentication>.
If you cannot map your users in this way, things can get a bit messy.