Comprehensive Guide: Implementing RBAC with Spring Security and JWT

RBAC (Role‑Based Access Control) is introduced as a method of linking users to roles and roles to permissions, allowing indirect assignment of permissions to users. The article first defines RBAC and presents a mind‑map illustration.

RBAC Model Classification

The four RBAC models are described:

RBAC0 : the basic model, supporting both many‑to‑one and many‑to‑many relationships between users and roles. Example: a user "Zhang San" holds both an administrative and a financial role, thus acquiring two separate permission sets.

RBAC1 : adds role hierarchy (sub‑roles) and inheritance.

RBAC2 : extends RBAC0 with constraints such as role mutual exclusion, cardinality limits, prerequisite roles, and runtime separation. Each constraint is illustrated with a concrete scenario (e.g., a user cannot simultaneously hold "accountant" and "auditor" roles).

RBAC3 : combines RBAC1 and RBAC2 into a unified model.

User Group Usage

Grouping users enables batch granting of roles, reducing repetitive work when many users share the same role (e.g., assigning a role to ten thousand employees in a department).

Simple Spring Security Example

Steps to add Spring Security:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
  <version>2.3.1.RELEASE</version>
</dependency>

Define a REST controller, then configure in‑memory authentication:

package com.example.demo.web;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/test")
public class Test {
    @RequestMapping("/test")
    public String test(){
        return "test";
    }
}

Configure the security settings to permit all requests for demonstration purposes and set a username/password in application.yml:

spring:
  security:
    user:
      name: ming
      password: 123456
      roles: admin

Integrating JWT with Spring Security

Dependencies for JWT and Spring Security are added:

<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt</artifactId>
  <version>0.9.1</version>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
  <version>2.3.1.RELEASE</version>
</dependency>

Key classes:

JwtUser : implements UserDetails and holds username, password, state, and authorities.

JwtTokenUtil : creates, parses, validates, and refreshes JWT tokens using a secret and expiration time.

JwtAuthenticationTokenFilter : extracts the token from the request header, validates it, and sets the authentication in the security context.

JwtUserDetailsServiceImpl : loads a user from the database and converts roles to SimpleGrantedAuthority objects.

UserServiceImpl : authenticates a user, generates a token via JwtTokenUtil, and returns it in a RetResult.

Security configuration registers the filter before UsernamePasswordAuthenticationFilter and defines URL rules (e.g., permitting /auth/** and requiring authentication for others).

JSON‑Based Login

A custom filter CustomAuthenticationFilter overrides attemptAuthentication to read JSON payloads (username and password) using Jackson. The filter is registered in the security config, replacing the default filter and mapping to /login/self. Success and failure handlers return appropriate responses.

Password Encryption

A BCryptPasswordEncoder bean is defined and injected into service layers. When creating or updating a user, the password is encoded with bCryptPasswordEncoder.encode(). During login, bCryptPasswordEncoder.matches() verifies the raw password against the stored hash.

Database Authentication

The article shows how to configure UserDetailsService to fetch users from a database, set up role‑based URL protection (e.g., .antMatchers("/admin/**").hasRole("admin")), and use formLogin() with a custom login processing URL.

Data Model Design

A simple ER diagram is presented for users, roles, and permissions, illustrating the many‑to‑many relationship and how roles are linked to permissions.

Final Remarks

The guide emphasizes the end‑to‑end process of configuring RBAC in a Spring Boot application, from basic in‑memory security to full JWT‑based stateless authentication, JSON login handling, and secure password storage.