How can I secure Spring controller methods for user roles?

I have USER, ROLE and USER_ROLE tables and 开发者_StackOverflowa bunch Spring controllers ... is there an Spring annotation I can add to the controller methods that will specify the role(s) a user should have to be able to access it?

I guess it's going to be Spring security? Is that straighforward to wire up to an existing user/role schema?

I'm using Spring 2.5.4.

Spring Security is going to be your easiest way to do it. What you're asking for specifically is Method Security Expressions. You can achieve this by using the following:

@PreAuthorize("hasRole('ROLE_ADMIN')")
public void deleteUser(User user) {
  ...
}

It's pretty straightforward to set up Spring Security with a database backend. I'd take a look at the DAOAuthenticationProvider as a starting point.

Spring Security annotations, as follows:

@Secured({"ROLE_1", "ROLE_2"})
public String mySecuredHander() {
   return "foo";
}