JAVA-6 : new module spring-security-mvc-boot-1

2020-02-17 21:52:37 +05:30
parent 0bfbec65dd
commit aecfad9448
87 changed files with 3801 additions and 0 deletions
@@ -0,0 +1,17 @@
+## Spring Boot Security MVC - 1
+
+This module contains articles about Spring Security with Spring MVC in Boot applications
+
+### The Course
+The "REST With Spring" Classes: http://github.learnspringsecurity.com
+
+### Relevant Articles:
+- [A Custom Security Expression with Spring Security](https://www.baeldung.com/spring-security-create-new-custom-security-expression)
+- [Custom AccessDecisionVoters in Spring Security](https://www.baeldung.com/spring-security-custom-voter)
+- [Spring Security: Authentication with a Database-backed UserDetailsService](https://www.baeldung.com/spring-security-authentication-with-a-database)
+- [Spring Data with Spring Security](https://www.baeldung.com/spring-data-security)
+- [Granted Authority Versus Role in Spring Security](https://www.baeldung.com/spring-security-granted-authority-vs-role)
+- [Spring Security – Whitelist IP Range](https://www.baeldung.com/spring-security-whitelist-ip-range)
+- [Find the Registered Spring Security Filters](https://www.baeldung.com/spring-security-registered-filters)
+- More articles: [[next -->]](/../spring-security-mvc-boot-2)
+
@@ -0,0 +1,3 @@
+Manifest-Version: 1.0
+Class-Path: 
+
@@ -0,0 +1,240 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>spring-security-mvc-boot-1</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+    <name>spring-security-mvc-boot-1</name>
+    <packaging>war</packaging>
+    <description>Spring Security MVC Boot - 1</description>
+
+    <parent>
+        <groupId>com.baeldung</groupId>
+        <artifactId>parent-boot-2</artifactId>
+        <version>0.0.1-SNAPSHOT</version>
+        <relativePath>../../parent-boot-2</relativePath>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-tomcat</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-thymeleaf</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.thymeleaf.extras</groupId>
+            <artifactId>thymeleaf-extras-springsecurity5</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-jpa</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-data</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>mysql</groupId>
+            <artifactId>mysql-connector-java</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hamcrest</groupId>
+            <artifactId>hamcrest-core</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.hamcrest</groupId>
+            <artifactId>hamcrest-library</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>taglibs</groupId>
+            <artifactId>standard</artifactId>
+            <version>${taglibs-standard.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-taglibs</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>javax.servlet.jsp.jstl</groupId>
+            <artifactId>jstl-api</artifactId>
+            <version>${jstl.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-config</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-context-support</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>net.sf.ehcache</groupId>
+            <artifactId>ehcache-core</artifactId>
+            <version>${ehcache-core.version}</version>
+            <type>jar</type>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.codehaus.cargo</groupId>
+                <artifactId>cargo-maven2-plugin</artifactId>
+                <version>${cargo-maven2-plugin.version}</version>
+                <configuration>
+                    <wait>true</wait>
+                    <container>
+                        <containerId>tomcat8x</containerId>
+                        <type>embedded</type>
+                        <systemProperties>
+                            <!-- <provPersistenceTarget>cargo</provPersistenceTarget> -->
+                        </systemProperties>
+                    </container>
+                    <configuration>
+                        <properties>
+                            <cargo.servlet.port>8082</cargo.servlet.port>
+                        </properties>
+                    </configuration>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>live</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.codehaus.cargo</groupId>
+                        <artifactId>cargo-maven2-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>start-server</id>
+                                <phase>pre-integration-test</phase>
+                                <goals>
+                                    <goal>start</goal>
+                                </goals>
+                            </execution>
+                            <execution>
+                                <id>stop-server</id>
+                                <phase>post-integration-test</phase>
+                                <goals>
+                                    <goal>stop</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <phase>integration-test</phase>
+                                <goals>
+                                    <goal>test</goal>
+                                </goals>
+                                <configuration>
+                                    <excludes>
+                                        <exclude>none</exclude>
+                                    </excludes>
+                                    <includes>
+                                        <include>**/*LiveTest.java</include>
+                                    </includes>
+                                    <systemPropertyVariables>
+                                        <webTarget>cargo</webTarget>
+                                    </systemPropertyVariables>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+
+        <profile>
+            <id>entryPoints</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-surefire-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <phase>integration-test</phase>
+                                <goals>
+                                    <goal>test</goal>
+                                </goals>
+                                <configuration>
+                                    <excludes>
+                                        <exclude>**/*LiveTest.java</exclude>
+                                        <exclude>**/*IntegrationTest.java</exclude>
+                                        <exclude>**/*IntTest.java</exclude>
+                                    </excludes>
+                                    <includes>
+                                        <include>**/*EntryPointsTest.java</include>
+                                    </includes>
+                                </configuration>
+                            </execution>
+                        </executions>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <test.mime>json</test.mime>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+
+    <properties>
+        <start-class>org.baeldung.custom.Application</start-class>
+        <!--If you want to run the example with the voters comment the tag 
+            above and uncomment the one below -->
+        <!--<start-class>org.baeldung.voter.VoterApplication</start-class> -->
+     
+        <taglibs-standard.version>1.1.2</taglibs-standard.version>
+        <cargo-maven2-plugin.version>1.6.1</cargo-maven2-plugin.version>
+        <ehcache-core.version>2.6.11</ehcache-core.version>
+    </properties>
+
+</project>
@@ -0,0 +1,64 @@
+package com.baeldung;
+
+import java.util.Properties;
+
+import javax.sql.DataSource;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Import;
+import org.springframework.context.annotation.PropertySource;
+import org.springframework.core.env.Environment;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
+import org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+
+@SpringBootApplication
+@PropertySource({"classpath:persistence-h2.properties", "classpath:application-defaults.properties"})
+@EnableJpaRepositories(basePackages = { "com.baeldung.data.repositories" })
+@EnableWebMvc
+@Import(SpringSecurityConfig.class)
+public class AppConfig extends WebMvcConfigurerAdapter {
+
+    @Autowired
+    private Environment env;
+
+    @Bean
+    public DataSource dataSource() {
+        final DriverManagerDataSource dataSource = new DriverManagerDataSource();
+        dataSource.setDriverClassName(env.getProperty("driverClassName"));
+        dataSource.setUrl(env.getProperty("url"));
+        dataSource.setUsername(env.getProperty("user"));
+        dataSource.setPassword(env.getProperty("password"));
+        return dataSource;
+    }
+
+    @Bean
+    public LocalContainerEntityManagerFactoryBean entityManagerFactory() {
+        final LocalContainerEntityManagerFactoryBean em = new LocalContainerEntityManagerFactoryBean();
+        em.setDataSource(dataSource());
+        em.setPackagesToScan(new String[] { "com.baeldung.models" });
+        em.setJpaVendorAdapter(new HibernateJpaVendorAdapter());
+        em.setJpaProperties(additionalProperties());
+        return em;
+    }
+
+    final Properties additionalProperties() {
+        final Properties hibernateProperties = new Properties();
+        if (env.getProperty("hibernate.hbm2ddl.auto") != null) {
+            hibernateProperties.setProperty("hibernate.hbm2ddl.auto", env.getProperty("hibernate.hbm2ddl.auto"));
+        }
+        if (env.getProperty("hibernate.dialect") != null) {
+            hibernateProperties.setProperty("hibernate.dialect", env.getProperty("hibernate.dialect"));
+        }
+        if (env.getProperty("hibernate.show_sql") != null) {
+            hibernateProperties.setProperty("hibernate.show_sql", env.getProperty("hibernate.show_sql"));
+        }
+        return hibernateProperties;
+    }
+
+}
@@ -0,0 +1,89 @@
+package com.baeldung;
+
+import javax.annotation.PostConstruct;
+import javax.sql.DataSource;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.data.repository.query.SecurityEvaluationContextExtension;
+import org.springframework.web.context.WebApplicationContext;
+
+import com.baeldung.security.AuthenticationSuccessHandlerImpl;
+import com.baeldung.security.CustomUserDetailsService;
+
+@Configuration
+@EnableWebSecurity
+@ComponentScan("com.baeldung.security")
+public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    private WebApplicationContext applicationContext;
+    private CustomUserDetailsService userDetailsService;
+    @Autowired
+    private AuthenticationSuccessHandlerImpl successHandler;
+    @Autowired
+    private DataSource dataSource;
+
+    @PostConstruct
+    public void completeSetup() {
+        userDetailsService = applicationContext.getBean(CustomUserDetailsService.class);
+    }
+
+    @Override
+    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
+        auth.userDetailsService(userDetailsService)
+            .passwordEncoder(encoder())
+            .and()
+            .authenticationProvider(authenticationProvider())
+            .jdbcAuthentication()
+            .dataSource(dataSource);
+    }
+
+    @Override
+    public void configure(WebSecurity web) throws Exception {
+        web.ignoring()
+            .antMatchers("/resources/**");
+    }
+
+    @Override
+    protected void configure(final HttpSecurity http) throws Exception {
+        http.authorizeRequests()
+            .antMatchers("/login")
+            .permitAll()
+            .and()
+            .formLogin()
+            .permitAll()
+            .successHandler(successHandler)
+            .and()
+            .csrf()
+            .disable();
+    }
+
+    @Bean
+    public DaoAuthenticationProvider authenticationProvider() {
+        final DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
+        authProvider.setUserDetailsService(userDetailsService);
+        authProvider.setPasswordEncoder(encoder());
+        return authProvider;
+    }
+
+    @Bean
+    public PasswordEncoder encoder() {
+        return new BCryptPasswordEncoder(11);
+    }
+
+    @Bean
+    public SecurityEvaluationContextExtension securityEvaluationContextExtension() {
+        return new SecurityEvaluationContextExtension();
+    }
+}
@@ -0,0 +1,14 @@
+package com.baeldung.data.repositories;
+
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.PagingAndSortingRepository;
+
+import com.baeldung.models.Tweet;
+
+public interface TweetRepository extends PagingAndSortingRepository<Tweet, Long> {
+
+    @Query("select twt from Tweet twt  JOIN twt.likes as lk where lk = ?#{ principal?.username } or twt.owner = ?#{ principal?.username }")
+    Page<Tweet> getMyTweetsAndTheOnesILiked(Pageable pageable);
+}
@@ -0,0 +1,26 @@
+package com.baeldung.data.repositories;
+
+import java.util.Date;
+import java.util.List;
+
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.CrudRepository;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+import org.springframework.transaction.annotation.Transactional;
+
+import com.baeldung.models.AppUser;
+
+public interface UserRepository extends CrudRepository<AppUser, Long> {
+    AppUser findByUsername(String username);
+
+    List<AppUser> findByName(String name);
+
+    @Query("UPDATE AppUser u SET u.lastLogin=:lastLogin WHERE u.username = ?#{ principal?.username }")
+    @Modifying
+    @Transactional
+    public void updateLastLogin(@Param("lastLogin") Date lastLogin);
+}
@@ -0,0 +1,83 @@
+package com.baeldung.models;
+
+import java.util.Date;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "users")
+public class AppUser {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.SEQUENCE)
+    private long id;
+
+    private String name;
+    @Column(unique = true)
+    private String username;
+    private String password;
+    private boolean enabled = true;
+    private Date lastLogin;
+
+    private AppUser() {
+    }
+
+    public AppUser(String name, String email, String password) {
+        this.username = email;
+        this.name = name;
+        this.password = password;
+    }
+
+    public long getId() {
+        return id;
+    }
+
+    public void setId(long id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public Date getLastLogin() {
+        return lastLogin;
+    }
+
+    public void setLastLogin(Date lastLogin) {
+        this.lastLogin = lastLogin;
+    }
+}
@@ -0,0 +1,67 @@
+package com.baeldung.models;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import javax.persistence.CollectionTable;
+import javax.persistence.ElementCollection;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "Tweet")
+public class Tweet {
+    @Id
+    @GeneratedValue(strategy = GenerationType.SEQUENCE)
+    private long id;
+    private String tweet;
+    private String owner;
+    @ElementCollection(targetClass = String.class, fetch = FetchType.EAGER)
+    @CollectionTable(name = "Tweet_Likes")
+    private Set<String> likes = new HashSet<>();
+
+    public long getId() {
+        return id;
+    }
+
+    public void setId(long id) {
+        this.id = id;
+    }
+
+    private Tweet() {
+    }
+
+    public Tweet(String tweet, String owner) {
+        this.tweet = tweet;
+        this.owner = owner;
+    }
+
+    public String getTweet() {
+        return tweet;
+    }
+
+    public void setTweet(String tweet) {
+        this.tweet = tweet;
+    }
+
+    public String getOwner() {
+        return owner;
+    }
+
+    public void setOwner(String owner) {
+        this.owner = owner;
+    }
+
+    public Set<String> getLikes() {
+        return likes;
+    }
+
+    public void setLikes(Set<String> likes) {
+        this.likes = likes;
+    }
+
+}
@@ -0,0 +1,67 @@
+package com.baeldung.security;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import com.baeldung.models.AppUser;
+
+public class AppUserPrincipal implements UserDetails {
+
+    private final AppUser user;
+
+    //
+
+    public AppUserPrincipal(AppUser user) {
+        this.user = user;
+    }
+
+    //
+
+    @Override
+    public String getUsername() {
+        return user.getUsername();
+    }
+
+    @Override
+    public String getPassword() {
+        return user.getPassword();
+    }
+
+    @Override
+    public Collection<? extends GrantedAuthority> getAuthorities() {
+        final List<GrantedAuthority> authorities = Collections.singletonList(new SimpleGrantedAuthority("User"));
+        return authorities;
+    }
+
+    @Override
+    public boolean isAccountNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isAccountNonLocked() {
+        return true;
+    }
+
+    @Override
+    public boolean isCredentialsNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return true;
+    }
+
+    //
+
+    public AppUser getAppUser() {
+        return user;
+    }
+
+}
@@ -0,0 +1,28 @@
+package com.baeldung.security;
+
+import java.io.IOException;
+import java.util.Date;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.stereotype.Component;
+
+import com.baeldung.data.repositories.UserRepository;
+
+@Component
+public class AuthenticationSuccessHandlerImpl implements AuthenticationSuccessHandler {
+
+    @Autowired
+    private UserRepository userRepository;
+
+    @Override
+    public void onAuthenticationSuccess(HttpServletRequest arg0, HttpServletResponse arg1, Authentication arg2) throws IOException, ServletException {
+        userRepository.updateLastLogin(new Date());
+    }
+
+}
@@ -0,0 +1,40 @@
+package com.baeldung.security;
+
+import javax.annotation.PostConstruct;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+import org.springframework.web.context.WebApplicationContext;
+
+import com.baeldung.data.repositories.UserRepository;
+import com.baeldung.models.AppUser;
+
+@Service
+public class CustomUserDetailsService implements UserDetailsService {
+
+    @Autowired
+    private WebApplicationContext applicationContext;
+    private UserRepository userRepository;
+
+    public CustomUserDetailsService() {
+        super();
+    }
+
+    @PostConstruct
+    public void completeSetup() {
+        userRepository = applicationContext.getBean(UserRepository.class);
+    }
+
+    @Override
+    public UserDetails loadUserByUsername(final String username) {
+        final AppUser appUser = userRepository.findByUsername(username);
+        if (appUser == null) {
+            throw new UsernameNotFoundException(username);
+        }
+        return new AppUserPrincipal(appUser);
+    }
+
+}
@@ -0,0 +1,63 @@
+package com.baeldung.util;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Random;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+
+import com.baeldung.models.AppUser;
+import com.baeldung.models.Tweet;
+
+public class DummyContentUtil {
+    
+    public static final List<AppUser> generateDummyUsers() {
+        List<AppUser> appUsers = new ArrayList<>();
+        BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
+        appUsers.add(new AppUser("Lionel Messi", "[email protected]", passwordEncoder.encode("li1234")));
+        appUsers.add(new AppUser("Cristiano Ronaldo", "[email protected]", passwordEncoder.encode("c1234")));
+        appUsers.add(new AppUser("Neymar Dos Santos", "[email protected]", passwordEncoder.encode("n1234")));
+        appUsers.add(new AppUser("Luiz Suarez", "[email protected]", passwordEncoder.encode("lu1234")));
+        appUsers.add(new AppUser("Andres Iniesta", "[email protected]", passwordEncoder.encode("a1234")));
+        appUsers.add(new AppUser("Ivan Rakitic", "[email protected]", passwordEncoder.encode("i1234")));
+        appUsers.add(new AppUser("Ousman Dembele", "[email protected]", passwordEncoder.encode("o1234")));
+        appUsers.add(new AppUser("Sergio Busquet", "[email protected]", passwordEncoder.encode("s1234")));
+        appUsers.add(new AppUser("Gerard Pique", "[email protected]", passwordEncoder.encode("g1234")));
+        appUsers.add(new AppUser("Ter Stergen", "[email protected]", passwordEncoder.encode("t1234")));
+        return appUsers;
+    }
+
+    public static final List<Tweet> generateDummyTweets(List<AppUser> users) {
+        List<Tweet> tweets = new ArrayList<>();
+        Random random = new Random();
+        IntStream.range(0, 9)
+            .sequential()
+            .forEach(i -> {
+                Tweet twt = new Tweet(String.format("Tweet %d", i), users.get(random.nextInt(users.size()))
+                    .getUsername());
+                twt.getLikes()
+                    .addAll(users.subList(0, random.nextInt(users.size()))
+                        .stream()
+                        .map(AppUser::getUsername)
+                        .collect(Collectors.toSet()));
+                tweets.add(twt);
+            });
+        return tweets;
+    }
+
+    public static Collection<GrantedAuthority> getAuthorities() {
+        Collection<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
+        GrantedAuthority grantedAuthority = new GrantedAuthority() {
+            public String getAuthority() {
+                return "ROLE_USER";
+            }
+        };
+        grantedAuthorities.add(grantedAuthority);
+        return grantedAuthorities;
+    }
+
+}
@@ -0,0 +1,14 @@
+package org.baeldung.custom;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.web.servlet.support.SpringBootServletInitializer;
+import org.springframework.context.annotation.PropertySource;
+
+@SpringBootApplication
+@PropertySource("classpath:application-defaults.properties")
+public class Application extends SpringBootServletInitializer {
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+}
@@ -0,0 +1,21 @@
+package org.baeldung.custom.config;
+
+import org.baeldung.custom.security.CustomMethodSecurityExpressionHandler;
+import org.baeldung.custom.security.CustomPermissionEvaluator;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
+
+@Configuration
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
+
+    @Override
+    protected MethodSecurityExpressionHandler createExpressionHandler() {
+        // final DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
+        final CustomMethodSecurityExpressionHandler expressionHandler = new CustomMethodSecurityExpressionHandler();
+        expressionHandler.setPermissionEvaluator(new CustomPermissionEvaluator());
+        return expressionHandler;
+    }
+}
@@ -0,0 +1,41 @@
+package org.baeldung.custom.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
+import org.springframework.web.servlet.config.annotation.DefaultServletHandlerConfigurer;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
+import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+@EnableWebMvc
+public class MvcConfig implements WebMvcConfigurer {
+
+    public MvcConfig() {
+        super();
+    }
+
+    //
+    @Bean
+    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
+        return new PropertySourcesPlaceholderConfigurer();
+    }
+
+    @Override
+    public void configureDefaultServletHandling(final DefaultServletHandlerConfigurer configurer) {
+        configurer.enable();
+    }
+
+    @Override
+    public void addViewControllers(final ViewControllerRegistry registry) {
+        registry.addViewController("/").setViewName("forward:/index");
+        registry.addViewController("/index");
+    }
+
+    @Override
+    public void addResourceHandlers(final ResourceHandlerRegistry registry) {
+        registry.addResourceHandler("/resources/**").addResourceLocations("/resources/");
+    }
+}
@@ -0,0 +1,15 @@
+package org.baeldung.custom.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    public PasswordEncoder encoder() {
+        return new BCryptPasswordEncoder(11);
+    }
+}
@@ -0,0 +1,73 @@
+package org.baeldung.custom.persistence;
+
+import java.util.Arrays;
+import java.util.HashSet;
+
+import javax.annotation.PostConstruct;
+
+import org.baeldung.custom.persistence.dao.OrganizationRepository;
+import org.baeldung.custom.persistence.dao.PrivilegeRepository;
+import org.baeldung.custom.persistence.dao.UserRepository;
+import org.baeldung.custom.persistence.model.Organization;
+import org.baeldung.custom.persistence.model.Privilege;
+import org.baeldung.custom.persistence.model.User;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Component;
+
+@Component
+public class SetupData {
+    @Autowired
+    private UserRepository userRepository;
+
+    @Autowired
+    private PrivilegeRepository privilegeRepository;
+
+    @Autowired
+    private OrganizationRepository organizationRepository;
+
+    @Autowired
+    private PasswordEncoder encoder;
+
+    @PostConstruct
+    public void init() {
+        initOrganizations();
+        initPrivileges();
+        initUsers();
+    }
+
+    private void initUsers() {
+        final Privilege privilege1 = privilegeRepository.findByName("FOO_READ_PRIVILEGE");
+        final Privilege privilege2 = privilegeRepository.findByName("FOO_WRITE_PRIVILEGE");
+        //
+        final User user1 = new User();
+        user1.setUsername("john");
+        user1.setPassword(encoder.encode("123"));
+        user1.setPrivileges(new HashSet<Privilege>(Arrays.asList(privilege1)));
+        user1.setOrganization(organizationRepository.findByName("FirstOrg"));
+        userRepository.save(user1);
+        //
+        final User user2 = new User();
+        user2.setUsername("tom");
+        user2.setPassword(encoder.encode("111"));
+        user2.setPrivileges(new HashSet<Privilege>(Arrays.asList(privilege1, privilege2)));
+        user2.setOrganization(organizationRepository.findByName("SecondOrg"));
+        userRepository.save(user2);
+    }
+
+    private void initOrganizations() {
+        final Organization org1 = new Organization("FirstOrg");
+        organizationRepository.save(org1);
+        //
+        final Organization org2 = new Organization("SecondOrg");
+        organizationRepository.save(org2);
+    }
+
+    private void initPrivileges() {
+        final Privilege privilege1 = new Privilege("FOO_READ_PRIVILEGE");
+        privilegeRepository.save(privilege1);
+        //
+        final Privilege privilege2 = new Privilege("FOO_WRITE_PRIVILEGE");
+        privilegeRepository.save(privilege2);
+    }
+}
@@ -0,0 +1,10 @@
+package org.baeldung.custom.persistence.dao;
+
+import org.baeldung.custom.persistence.model.Organization;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface OrganizationRepository extends JpaRepository<Organization, Long> {
+
+    public Organization findByName(String name);
+
+}
@@ -0,0 +1,10 @@
+package org.baeldung.custom.persistence.dao;
+
+import org.baeldung.custom.persistence.model.Privilege;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+public interface PrivilegeRepository extends JpaRepository<Privilege, Long> {
+
+    public Privilege findByName(String name);
+
+}
@@ -0,0 +1,14 @@
+package org.baeldung.custom.persistence.dao;
+
+import org.baeldung.custom.persistence.model.User;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.transaction.annotation.Transactional;
+
+public interface UserRepository extends JpaRepository<User, Long> {
+
+    User findByUsername(final String username);
+
+    @Transactional
+    void removeUserByUsername(String username);
+
+}
@@ -0,0 +1,94 @@
+package org.baeldung.custom.persistence.model;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+
+@Entity
+public class Foo {
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+
+    @Column(nullable = false)
+    private String name;
+
+    //
+
+    public Foo() {
+        super();
+    }
+
+    public Foo(String name) {
+        super();
+        this.name = name;
+    }
+
+    //
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    //
+
+    @Override
+    public String toString() {
+        final StringBuilder builder = new StringBuilder();
+        builder.append("Foo [id=").append(id).append(", name=").append(name).append("]");
+        return builder.toString();
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = (prime * result) + ((id == null) ? 0 : id.hashCode());
+        result = (prime * result) + ((name == null) ? 0 : name.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Foo other = (Foo) obj;
+        if (id == null) {
+            if (other.id != null) {
+                return false;
+            }
+        } else if (!id.equals(other.id)) {
+            return false;
+        }
+        if (name == null) {
+            if (other.name != null) {
+                return false;
+            }
+        } else if (!name.equals(other.name)) {
+            return false;
+        }
+        return true;
+    }
+
+}
@@ -0,0 +1,95 @@
+package org.baeldung.custom.persistence.model;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+
+@Entity
+public class Organization {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+
+    @Column(nullable = false, unique = true)
+    private String name;
+
+    //
+
+    public Organization() {
+        super();
+    }
+
+    public Organization(String name) {
+        super();
+        this.name = name;
+    }
+
+    //
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    //
+
+    @Override
+    public String toString() {
+        final StringBuilder builder = new StringBuilder();
+        builder.append("Organization [id=").append(id).append(", name=").append(name).append("]");
+        return builder.toString();
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = (prime * result) + ((id == null) ? 0 : id.hashCode());
+        result = (prime * result) + ((name == null) ? 0 : name.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Organization other = (Organization) obj;
+        if (id == null) {
+            if (other.id != null) {
+                return false;
+            }
+        } else if (!id.equals(other.id)) {
+            return false;
+        }
+        if (name == null) {
+            if (other.name != null) {
+                return false;
+            }
+        } else if (!name.equals(other.name)) {
+            return false;
+        }
+        return true;
+    }
+
+}
@@ -0,0 +1,95 @@
+package org.baeldung.custom.persistence.model;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+
+@Entity
+public class Privilege {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+
+    @Column(nullable = false, unique = true)
+    private String name;
+
+    //
+
+    public Privilege() {
+        super();
+    }
+
+    public Privilege(String name) {
+        super();
+        this.name = name;
+    }
+
+    //
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    //
+
+    @Override
+    public String toString() {
+        final StringBuilder builder = new StringBuilder();
+        builder.append("Privilege [id=").append(id).append(", name=").append(name).append("]");
+        return builder.toString();
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = (prime * result) + ((id == null) ? 0 : id.hashCode());
+        result = (prime * result) + ((name == null) ? 0 : name.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final Privilege other = (Privilege) obj;
+        if (id == null) {
+            if (other.id != null) {
+                return false;
+            }
+        } else if (!id.equals(other.id)) {
+            return false;
+        }
+        if (name == null) {
+            if (other.name != null) {
+                return false;
+            }
+        } else if (!name.equals(other.name)) {
+            return false;
+        }
+        return true;
+    }
+
+}
@@ -0,0 +1,155 @@
+package org.baeldung.custom.persistence.model;
+
+import java.util.Set;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.JoinTable;
+import javax.persistence.ManyToMany;
+import javax.persistence.ManyToOne;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "user_table")
+public class User {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.AUTO)
+    private Long id;
+
+    @Column(nullable = false, unique = true)
+    private String username;
+
+    private String password;
+
+    @ManyToMany(fetch = FetchType.EAGER)
+    @JoinTable(name = "users_privileges", joinColumns = @JoinColumn(name = "user_id", referencedColumnName = "id"), inverseJoinColumns = @JoinColumn(name = "privilege_id", referencedColumnName = "id"))
+    private Set<Privilege> privileges;
+
+    @ManyToOne(fetch = FetchType.EAGER)
+    @JoinColumn(name = "organization_id", referencedColumnName = "id")
+    private Organization organization;
+
+    //
+
+    public User() {
+        super();
+    }
+
+    //
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public Set<Privilege> getPrivileges() {
+        return privileges;
+    }
+
+    public void setPrivileges(Set<Privilege> privileges) {
+        this.privileges = privileges;
+    }
+
+    public Organization getOrganization() {
+        return organization;
+    }
+
+    public void setOrganization(Organization organization) {
+        this.organization = organization;
+    }
+
+    //
+
+    @Override
+    public String toString() {
+        final StringBuilder builder = new StringBuilder();
+        builder.append("User [id=").append(id).append(", username=").append(username).append(", password=").append(password).append(", privileges=").append(privileges).append(", organization=").append(organization).append("]");
+        return builder.toString();
+    }
+
+    @Override
+    public int hashCode() {
+        final int prime = 31;
+        int result = 1;
+        result = (prime * result) + ((id == null) ? 0 : id.hashCode());
+        result = (prime * result) + ((organization == null) ? 0 : organization.hashCode());
+        result = (prime * result) + ((password == null) ? 0 : password.hashCode());
+        result = (prime * result) + ((privileges == null) ? 0 : privileges.hashCode());
+        result = (prime * result) + ((username == null) ? 0 : username.hashCode());
+        return result;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final User other = (User) obj;
+        if (id == null) {
+            if (other.id != null) {
+                return false;
+            }
+        } else if (!id.equals(other.id)) {
+            return false;
+        }
+        if (organization == null) {
+            if (other.organization != null) {
+                return false;
+            }
+        } else if (!organization.equals(other.organization)) {
+            return false;
+        }
+        if (password == null) {
+            if (other.password != null) {
+                return false;
+            }
+        } else if (!password.equals(other.password)) {
+            return false;
+        }
+        if (privileges == null) {
+            if (other.privileges != null) {
+                return false;
+            }
+        } else if (!privileges.equals(other.privileges)) {
+            return false;
+        }
+        if (username == null) {
+            if (other.username != null) {
+                return false;
+            }
+        } else if (!username.equals(other.username)) {
+            return false;
+        }
+        return true;
+    }
+}
@@ -0,0 +1,22 @@
+package org.baeldung.custom.security;
+
+import org.aopalliance.intercept.MethodInvocation;
+import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
+import org.springframework.security.access.expression.method.MethodSecurityExpressionOperations;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.core.Authentication;
+
+public class CustomMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler {
+    private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
+
+    @Override
+    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, MethodInvocation invocation) {
+        // final CustomMethodSecurityExpressionRoot root = new CustomMethodSecurityExpressionRoot(authentication);
+        final MySecurityExpressionRoot root = new MySecurityExpressionRoot(authentication);
+        root.setPermissionEvaluator(getPermissionEvaluator());
+        root.setTrustResolver(this.trustResolver);
+        root.setRoleHierarchy(getRoleHierarchy());
+        return root;
+    }
+}
@@ -0,0 +1,50 @@
+package org.baeldung.custom.security;
+
+import org.baeldung.custom.persistence.model.User;
+import org.springframework.security.access.expression.SecurityExpressionRoot;
+import org.springframework.security.access.expression.method.MethodSecurityExpressionOperations;
+import org.springframework.security.core.Authentication;
+
+public class CustomMethodSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations {
+
+    private Object filterObject;
+    private Object returnObject;
+
+    public CustomMethodSecurityExpressionRoot(Authentication authentication) {
+        super(authentication);
+    }
+
+    //
+    public boolean isMember(Long OrganizationId) {
+        final User user = ((MyUserPrincipal) this.getPrincipal()).getUser();
+        return user.getOrganization().getId().longValue() == OrganizationId.longValue();
+    }
+
+    //
+
+    @Override
+    public Object getFilterObject() {
+        return this.filterObject;
+    }
+
+    @Override
+    public Object getReturnObject() {
+        return this.returnObject;
+    }
+
+    @Override
+    public Object getThis() {
+        return this;
+    }
+
+    @Override
+    public void setFilterObject(Object obj) {
+        this.filterObject = obj;
+    }
+
+    @Override
+    public void setReturnObject(Object obj) {
+        this.returnObject = obj;
+    }
+
+}
@@ -0,0 +1,40 @@
+package org.baeldung.custom.security;
+
+import java.io.Serializable;
+
+import org.springframework.security.access.PermissionEvaluator;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+
+public class CustomPermissionEvaluator implements PermissionEvaluator {
+
+    @Override
+    public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) {
+        if ((auth == null) || (targetDomainObject == null) || !(permission instanceof String)) {
+            return false;
+        }
+        final String targetType = targetDomainObject.getClass().getSimpleName().toUpperCase();
+        return hasPrivilege(auth, targetType, permission.toString().toUpperCase());
+    }
+
+    @Override
+    public boolean hasPermission(Authentication auth, Serializable targetId, String targetType, Object permission) {
+        if ((auth == null) || (targetType == null) || !(permission instanceof String)) {
+            return false;
+        }
+        return hasPrivilege(auth, targetType.toUpperCase(), permission.toString().toUpperCase());
+    }
+
+    private boolean hasPrivilege(Authentication auth, String targetType, String permission) {
+        for (final GrantedAuthority grantedAuth : auth.getAuthorities()) {
+            System.out.println("here " + grantedAuth);
+            if (grantedAuth.getAuthority().startsWith(targetType)) {
+                if (grantedAuth.getAuthority().contains(permission)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+}
@@ -0,0 +1,203 @@
+package org.baeldung.custom.security;
+
+import java.io.Serializable;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.baeldung.custom.persistence.model.User;
+import org.springframework.security.access.PermissionEvaluator;
+import org.springframework.security.access.expression.method.MethodSecurityExpressionOperations;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.AuthorityUtils;
+
+public class MySecurityExpressionRoot implements MethodSecurityExpressionOperations {
+    protected final Authentication authentication;
+    private AuthenticationTrustResolver trustResolver;
+    private RoleHierarchy roleHierarchy;
+    private Set<String> roles;
+    private String defaultRolePrefix = "ROLE_";
+
+    public final boolean permitAll = true;
+    public final boolean denyAll = false;
+    private PermissionEvaluator permissionEvaluator;
+    public final String read = "read";
+    public final String write = "write";
+    public final String create = "create";
+    public final String delete = "delete";
+    public final String admin = "administration";
+
+    //
+
+    private Object filterObject;
+    private Object returnObject;
+
+    public MySecurityExpressionRoot(Authentication authentication) {
+        if (authentication == null) {
+            throw new IllegalArgumentException("Authentication object cannot be null");
+        }
+        this.authentication = authentication;
+    }
+
+    @Override
+    public final boolean hasAuthority(String authority) {
+        throw new RuntimeException("method hasAuthority() not allowed");
+    }
+
+    //
+    public boolean isMember(Long OrganizationId) {
+        final User user = ((MyUserPrincipal) this.getPrincipal()).getUser();
+        return user.getOrganization().getId().longValue() == OrganizationId.longValue();
+    }
+
+    //
+
+    @Override
+    public final boolean hasAnyAuthority(String... authorities) {
+        return hasAnyAuthorityName(null, authorities);
+    }
+
+    @Override
+    public final boolean hasRole(String role) {
+        return hasAnyRole(role);
+    }
+
+    @Override
+    public final boolean hasAnyRole(String... roles) {
+        return hasAnyAuthorityName(defaultRolePrefix, roles);
+    }
+
+    private boolean hasAnyAuthorityName(String prefix, String... roles) {
+        final Set<String> roleSet = getAuthoritySet();
+
+        for (final String role : roles) {
+            final String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
+            if (roleSet.contains(defaultedRole)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    @Override
+    public final Authentication getAuthentication() {
+        return authentication;
+    }
+
+    @Override
+    public final boolean permitAll() {
+        return true;
+    }
+
+    @Override
+    public final boolean denyAll() {
+        return false;
+    }
+
+    @Override
+    public final boolean isAnonymous() {
+        return trustResolver.isAnonymous(authentication);
+    }
+
+    @Override
+    public final boolean isAuthenticated() {
+        return !isAnonymous();
+    }
+
+    @Override
+    public final boolean isRememberMe() {
+        return trustResolver.isRememberMe(authentication);
+    }
+
+    @Override
+    public final boolean isFullyAuthenticated() {
+        return !trustResolver.isAnonymous(authentication) && !trustResolver.isRememberMe(authentication);
+    }
+
+    public Object getPrincipal() {
+        return authentication.getPrincipal();
+    }
+
+    public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
+        this.trustResolver = trustResolver;
+    }
+
+    public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
+        this.roleHierarchy = roleHierarchy;
+    }
+
+    public void setDefaultRolePrefix(String defaultRolePrefix) {
+        this.defaultRolePrefix = defaultRolePrefix;
+    }
+
+    private Set<String> getAuthoritySet() {
+        if (roles == null) {
+            roles = new HashSet<String>();
+            Collection<? extends GrantedAuthority> userAuthorities = authentication.getAuthorities();
+
+            if (roleHierarchy != null) {
+                userAuthorities = roleHierarchy.getReachableGrantedAuthorities(userAuthorities);
+            }
+
+            roles = AuthorityUtils.authorityListToSet(userAuthorities);
+        }
+
+        return roles;
+    }
+
+    @Override
+    public boolean hasPermission(Object target, Object permission) {
+        return permissionEvaluator.hasPermission(authentication, target, permission);
+    }
+
+    @Override
+    public boolean hasPermission(Object targetId, String targetType, Object permission) {
+        return permissionEvaluator.hasPermission(authentication, (Serializable) targetId, targetType, permission);
+    }
+
+    public void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
+        this.permissionEvaluator = permissionEvaluator;
+    }
+
+    private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
+        if (role == null) {
+            return role;
+        }
+        if ((defaultRolePrefix == null) || (defaultRolePrefix.length() == 0)) {
+            return role;
+        }
+        if (role.startsWith(defaultRolePrefix)) {
+            return role;
+        }
+        return defaultRolePrefix + role;
+    }
+
+    @Override
+    public Object getFilterObject() {
+        return this.filterObject;
+    }
+
+    @Override
+    public Object getReturnObject() {
+        return this.returnObject;
+    }
+
+    @Override
+    public Object getThis() {
+        return this;
+    }
+
+    @Override
+    public void setFilterObject(Object obj) {
+        this.filterObject = obj;
+    }
+
+    @Override
+    public void setReturnObject(Object obj) {
+        this.returnObject = obj;
+    }
+}
@@ -0,0 +1,31 @@
+package org.baeldung.custom.security;
+
+import org.baeldung.custom.persistence.dao.UserRepository;
+import org.baeldung.custom.persistence.model.User;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.stereotype.Service;
+
+@Service
+public class MyUserDetailsService implements UserDetailsService {
+
+    @Autowired
+    private UserRepository userRepository;
+
+    public MyUserDetailsService() {
+        super();
+    }
+
+    // API
+
+    @Override
+    public UserDetails loadUserByUsername(final String username) {
+        final User user = userRepository.findByUsername(username);
+        if (user == null) {
+            throw new UsernameNotFoundException(username);
+        }
+        return new MyUserPrincipal(user);
+    }
+}
--- a/Show More
+++ b/Show More