baso53

@Configuration
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest()
                .authenticated();

        http.oauth2ResourceServer()

baso53

{
  "custom_claims": [
    "COMPANY:1:READ",
    "COMPANY:1:WRITE",
    "COMPANY:2:READ",
    "SUBSIDIARY:125:READ"
  ],
  "iss": "https://securetoken.google.com/fir-auth-springsecurity",
  "aud": "fir-auth-springsecurity",
  "auth_time": 1636893816,

baso53

INSERT INTO COMPANY(ID, NAME, TYPE) VALUES(1, 'Imaginary Solutions', 'LLC');
INSERT INTO COMPANY(ID, NAME, TYPE) VALUES(2, 'Green Innovations', 'LLC');

INSERT INTO SUBSIDIARY(ID, NAME, CITY, COMPANY_ID) VALUES(1, 'Imaginary Solutions California', 'Palo Alto', 1);
INSERT INTO SUBSIDIARY(ID, NAME, CITY, COMPANY_ID) VALUES(2, 'Imaginary Solutions Texas', 'Austin', 1);
INSERT INTO SUBSIDIARY(ID, NAME, CITY, COMPANY_ID) VALUES(3, 'Green Innovations Canada', 'Quebec', 2);

baso53

@RestController
@RequestMapping("/app")
@RequiredArgsConstructor
public class AppController {

    private final CompanyJpaRepository companyRepo;
    private final SubsidiaryJpaRepository subsidiaryRepo;

    @GetMapping(path = "/company/{id}")
    @PreAuthorize("hasAuthority('COMPANY:' + #id  + ':READ')")

baso53

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        http.oauth2ResourceServer()
                .jwt()
                .jwtAuthenticationConverter(jwtAuthenticationConverter());

baso53

@RequiredArgsConstructor
public class DomainGrantedAuthority implements GrantedAuthority {

    private final EntityType entityType;
    private final Long entityId;
    private final Permission permission;

    @Override
    public String getAuthority() {
        return entityType +

baso53

curl --location --request POST 'http://localhost:8080/admin/user-claims/WsD5H21KFKYyCOTIbkOwjXLQRsu1' \
--header 'Content-Type: application/json' \
--data-raw '{
    "COMPANY": {
        "1": [
            "READ",
            "WRITE"
        ],
        "2": [
            "READ"

baso53

@RestController
@RequestMapping("/admin")
@RequiredArgsConstructor
public class AdminController {

    private final UserManagementService userManagementService;

    @Secured("ROLE_ANONYMOUS")
    @PostMapping(path = "/user-claims/{uid}")
    public void setUserClaims(

baso53

[
  "COMPANY:1:READ",
  "COMPANY:1:WRITE",
  "COMPANY:2:READ",
  "SUBSIDIARY:125:READ"
]

baso53

{
    "COMPANY": {
        "1": [
            "READ",
            "WRITE"
        ],
        "2": [
            "READ"
        ]
    },