spring security redirect based on role

spring, spring-security

Solution

Write a spring controller which will serve different pages to be shown based on user role. Write Authentication success handler class and write code to decide where to redirect based on roles.

First of all `<form-login />` tag need to be changed.

<form-login login-page="/landing" authentication-success-handler-ref="authSuccessHandler" />

<beans:bean id="authSuccessHandler" class="com.package.AuthSuccessHandler" />

Remove `default-target-url` attribute. Let auth handler decide where to redirect the user.

Auth success handler class will be like :

public class AuthSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
    @Override
    protected String determineTargetUrl(HttpServletRequest request, HttpServletResponse response) {
        // Get the role of logged in user
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        String role = auth.getAuthorities().toString();

        String targetUrl = "";
        if(role.contains("client")) {
            targetUrl = "/client/index";
        } else if(role.contains("agency")) {
            targetUrl = "/agency/index";
        }
        return targetUrl;
    }
}

This is a sample code. Change it as per your requirements.

Problem

i have the following spring-security.xml file :- ``` <?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <http auto-config="true"> <intercept-url pattern="/Freelancer/**" access="ROLE_FREELANCE" /> <intercept-url pattern="/Client/**" access="ROLE_CLIENT" /> <intercept-url pattern="/Agency/**" access="ROLE_AGENCY" /> <intercept-url pattern="/Manager/**" access="ROLE_MANAGER" /> <intercept-url pattern="/User/**" access="ROLE_USER" /> <form-login default-target-url="/${role}" login-page="/login.jsp" /> <logout logout-url="/logout" logout-success-url="/" /> </http> <authentication-manager> <authentication-provider> <jdbc-user-service data-source-ref="dataSource" users-by-username-query="select user_name,password, enabled from Users where user_name=?" authorities-by-username-query="select u.user_name, u.role from Users u where u.user_name =?"/> </authentication-provider> </authentication-manager> </beans:beans> ``` what i want, i want to redirect the user to their workspace, for example if Client login then he will be redirected to the /Client/index.jsp, if Agency login, they will be redirected to the /Agency/index.jsp. is there any way to access the role before, he will be redirected to their workspace in spring-security.xml file. ``` <form-login default-target-url="/${role}" login-page="/login.jsp" /> ``` I have the directory structure similer to role. have any idea.

Original source