In the previous video, we looked at what's the difference between authority and roles now in this region?
Let's try to understand how to configure rules and perform a transition using them similar to authorities.
We also have three different methods.
Has rule has any rule access methods which will allow you to perform some configurations based upon
the rules, as you can expect, has will allow you to configure a single rule based upon which the user
will be allowed to access a particular endpoint.
Whereas has any rule you can mention any number of rules and the user has to have at least one of that
rule, which we configured using has any rule.
And accordingly he will be allowed to access the endpoints.
And like authorities, access method also is very better way of configuring.
If you have a complex requirements like based upon some conditions or conditions.
In that scenario we can go with the access method.
But while we are configuring the rules, we should have a rule underscore prefix added in the database.
And this is an indication for us and for the spring security.
OK, this is not a normal authority.
It is a role based access.
And at the same time, you don't have to mention the specifics while you're configuring these rules
inside your security code.
We can see that when we are checking the code and when what you do with the access method is it's not
only about the user authorities and rules, you can control the access to that particular API based
upon any condition.
Like you may have a scenario where the users from a particular country are where the users should be
able to access this, but only during certain time frame or certain date in all the scenarios.
Also, you can go ahead and leverage access method, whereas TasRail has any has a has any authority
that tied up with your authorities and rules.
So that's the main advantage of the access method.
Now let's try to go to the court and understand how we can configure our tradition based upon Royds.
First, I'll go to the database.
What I have done is previously we used to have read and write authorities, but I have already them
with the rules for the happy user.
There are two rules that we are configured for the happy customer.
One is role and the user and the other one is role and the score.
So whenever you want to use a role, has a role, has any role methods, we should definitely have this
role prefix attached in the database.
The reason is, while performing these comparison checks, spring security automatically will add a
prefix overall to the value that you provide.
That is why we should not configure the to prefix in the code, but only in the database.
So now we have it in the database.
Let's try to go to the court here.
You can see previously we used to have authorities, but now I have used a has rule, has any rule and
rules like user admin drut I have used here.
You can understand I am not prefixing anything with a rule underscored with this names.
The reason is spring security automatically will add a prefix rule.
Underscore Oscar.
We are using rule based methods.
So here you can clearly understand my account can be accessed by the users who has a role user.
My balance will be accessed by a user who has another user.
Admin role and influence will be accessed by the users who has a role.
And my card users are.
They are accessed by anyone who are authenticate with this configuration.
We should be able to access my account, my balance, my cards, but not the loans because my loans
need a brutal role and are happy.
Customer does not have that.
Let's try to go and validate that.
I'm trying to log in to the application and checking account.
I'm able to see the response.
Same with balance, same with cards.
But if I go on loans, we are not able to get the data that the reason for zero three at a.
So in this way we can configure authorization using rules and also authorities.
I hope now you understand how to perform authorization inside your application based upon authorities
roles and different ways to configure the same in your spring security code as well enough of authorization
in the next years.
Let's try to understand how to.
Perform restrictions on the EPA, but using different matches available inside out springs accurately,
as of now, we are only using and matches always, but we also have various methods and matches available
in spring security that we can easily leverage to perform restrictions on the EPA parts beyond the rules
and authorities.
Thank you.
And see you in the next video by.