0

I'm exploring the Spring framework, and in particular I am working on a Cinema Management Application that will be connected to a React.JS SPA (Single Page Application).

The problem is the following. On my database I do have three different tables representing three different types of users, namely Admin, Customer, and Cinema_Employee.

For each type of user, I created a @RestController with a list of RequestMethods that a particular user is able to perform:

"/admin" 
"/customer"
"/employee"

What I am trying to achieve now, it's to secure each endpoint offering three different login pages that will handle the authentication the respective type of user.

How can I set up three AuthenticationManager that handle different Authentication objects within a SecurityConfig class given these requirements, and most importantly, how can I override the Authorisation mindful that each user once has logged in, will have access only to the respective endpoint?

I looked carefully at other examples online, and most of them are radical different, following a pattern where the database has another additional 'Authorities' table aside the 'user' one that stores the credential. In my case this solution cannot be applied, not only because the whole design would become redundant, but also because the name of the table where the application will perform the authentication check against, explicitly imply the authorisation that a given user has inside the system.

WebStormer
  • 286
  • 3
  • 17
  • Does this answer your question? [Multiple user details services for different endpoints](https://stackoverflow.com/questions/49450556/multiple-user-details-services-for-different-endpoints) – Eleftheria Stein-Kousathana Feb 25 '21 at 08:54

1 Answers1

1

Your design sounds strange to me.
A user should have a role, e.g. Admin, Customer, Employee and based on the user's role he gets access to methods or not. Have a look at role based access control concepts. For Spring Security there is for example this tutorial:
https://www.baeldung.com/role-and-privilege-for-spring-security-registration

Elmar Brauch
  • 1,286
  • 6
  • 20
  • Thank you Elmar, indeed my design is a little strange, but there's a reason why I adopted it. Each table has specific associations with other tables (i.e. An employee has a OneToOne relation with a specific location_cinema, customers have OneToMany associations with tickets tables and so on). I thought that having one generic table representing the credentials of multiple users would have been even more confusing design wise. – WebStormer Feb 24 '21 at 18:03