Comprehensive Guide: Analyzing Role‑Based Access Control (RBAC) with Spring Security and JWT

RBAC (Role‑Based Access Control) links users to roles and roles to permissions, allowing permissions to be granted indirectly through role assignment. The article first defines RBAC and illustrates how a single user can hold multiple roles (e.g., an employee who is both an administrator and a finance officer) to simplify permission management and reduce security gaps.

RBAC Model Classification

The four standard RBAC models are described:

RBAC0 : the basic model, supporting many‑to‑one or many‑to‑many relationships between users and roles.

RBAC1 : adds role hierarchies (sub‑roles) to inherit permissions.

RBAC2 : introduces constraints such as mutually exclusive roles, cardinality limits, prerequisite roles, and runtime separation of duties, each explained with a concrete scenario.

RBAC3 : combines RBAC1 and RBAC2 into a unified model.

Simple Spring Security Example

A minimal Spring Boot project is set up by adding the spring-boot-starter-security dependency and creating a test controller:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>2.3.1.RELEASE</version>
</dependency>

The controller defines a /test endpoint returning a simple string. After starting the application, the default login page appears, and the user can log in with the generated credentials.

Integrating JWT with Spring Security

To enable stateless authentication, the article adds the jjwt library and creates several components: JwtUser implements UserDetails and stores username, password, state, and authorities. JwtTokenUtil generates, parses, refreshes, and validates JWT tokens using a secret key and expiration time. JwtAuthenticationTokenFilter extracts the token from the request header, validates it, and sets the security context. JwtUserDetailsServiceImpl loads a user from the database and builds a JwtUser instance. UserServiceImpl provides a login method that authenticates the user and returns a JWT token.

Configuration class WebSecurity disables CSRF, sets session management to stateless, permits the /auth/** endpoints, and registers the JWT filter before UsernamePasswordAuthenticationFilter. The resulting flow returns a JWT token after successful login, which can be used for subsequent requests.

Custom JSON Login Filter

For JSON‑based login, a custom filter extends UsernamePasswordAuthenticationFilter. It reads the request body when the content type is application/json, deserializes it into an AuthenticationBean, creates an authentication token, and delegates to the authentication manager. The filter is registered in SecurityConfig with

http.addFilterAt(customAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)

and configured to handle /login/self requests.

Password Encryption with BCrypt

The article shows how to declare a BCryptPasswordEncoder bean and use it in the service layer to hash passwords before persisting them. During login, the encoder’s matches method verifies the raw password against the stored hash, providing a secure password‑checking mechanism.

Database‑Backed Authentication

Finally, the guide demonstrates configuring Spring Security to use a custom UserDetailsService backed by a database. It includes a sample table design (image) and a WebSecurityConfig class that injects the user service, sets up role‑based URL protection (e.g., /admin/** requires the ADMIN role), and enables form‑based login.

In summary, the article covers RBAC theory, model variations, and a complete practical implementation using Spring Security, JWT, custom JSON login, and BCrypt password encryption, providing a clear, step‑by‑step reference for building secure backend services.