title: Spring boot how make a user role managing with jwt
body: <p>I'm writing a RESTful api with spring boot.
  I'm using spring boot, jersey, mongo db, swagger, spring boot security and jwt.</p>
  
  <p>I have written the models, the repositories for the requests to the DB. Now I have integrated the Security and jwt token.</p>
  
  <p>Now I need to discretize the role of the users, because a user cant call a route that need an admin priviledges.</p>
  
  <p>I have a route for login, it's return a token. This is the code of my SecurityConfig</p>
  
  <pre><code>...
  @Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter{
  
      @Autowired
      UserRepository userRepository;
  
      @Override
      public void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity.csrf().disable().authorizeRequests()
                  .antMatchers("/").permitAll()
                  .antMatchers("/api/swagger.json").permitAll()
                  .antMatchers(HttpMethod.POST, "/login").permitAll()
                  .antMatchers("/api/*").authenticated()
                  .and()
  
                  .addFilterBefore(new JWTLoginFilter("/login", authenticationManager(), userRepository),
                          UsernamePasswordAuthenticationFilter.class)
  
                  .addFilterBefore(new JWTAuthenticationFilter(),
                          UsernamePasswordAuthenticationFilter.class);
      }
  
  }
  </code></pre>
  
  <p>I written the JWTLoginFilter that return me the token when user makes login </p>
  
  <pre><code>...
  @Override
  public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException, IOException, ServletException {
      Credential creds = new ObjectMapper().readValue(req.getInputStream(), Credential.class);
  
      User user = userRepository.login(creds);
  
      if (user == null)
          throw new BadCredentialsException("");
  
      UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(
          creds.getUsername(),
          creds.getPassword()
      );
  
      return token;
  }
  ...
  </code></pre>
  
  <p>I want insert this on my endpoint class on method</p>
  
  <pre><code>@PreAuthorize("hasRole('ROLE_ADMIN')")
  </code></pre>
  
  <p>this is a part of an endpoint </p>
  
  <pre><code>....
  
  @Component
  @Path("story")
  @Api(value = "Story", produces = "application/json")
  public class StoryEndpoint {
  
      private static final Logger LOGGER = LoggerFactory.getLogger(StoryEndpoint.class);
  
      @Autowired
      StoryRepository storyRepository;
  
  
      @GET
      @Path("/")
      @Produces(MediaType.APPLICATION_JSON)
      @PreAuthorize("hasRole('ROLE_ADMIN')") &lt;--- I want insert here
      @ApiOperation(value = "Get All Story", response = Story.class)
      @ApiResponses(value = {
              @ApiResponse(code = 200, message = "hello resource found"),
              @ApiResponse(code = 404, message = "Given admin user not found")
      })
      public Response getAllStory(){
          Iterable&lt;Story&gt; stories = storyRepository.findAll();
          LOGGER.info("getAllStory");
          return (stories!=null) ? Response.ok(stories).build() : Response.ok(ResponseErrorGenerator.generate(Response.Status.NOT_FOUND)).status(Response.Status.NOT_FOUND).build();
      }
  ....
  </code></pre>
  
  <p>How I can make a mechanism for assign to user the role and how i can pass the role in token and discretize on route the role of user?</p>