title: Setting user roles based on some kind of ownership in Spring Security
body: <p>In my Spring-based application, I currently have basic roles such as ADMIN, and USER. </p>
  
  <p>Is it possible to define a user role such as PHOTO_UPLOADER, which inherits from USER, but also adds a check whether the user making the call is actually the owner of the photo? </p>
  
  <p>I am tired of writing the same <code>if (currentUser.id == photo.uploader.id)</code> in my controller actions over and over again. It applies to other entities as well.</p>