Accessing with restrictions

If we can use AOP to customize the user authentication process, we can also use it to establish the access control list and authorization rules.

Getting started

Given the roles, permissions, and permission sets of Chapter 4, Securing Spring MVC Applications, this recipe will implement the record deletion of employee records to ROLE_HR only. Open the Maven Eclipse ch05 project, and add the following features.

How to do it...

Let us simulate Spring Security's authorization process by using AOP concepts:

1. Although authorization can be implemented using the Spring Security framework, this recipe will provide us with another solution using AOP concepts. Inside the package org.packt.aop.transaction.controller, create an EmployeeController which will delete a record given an empId detail:

@Controller 
public class EmployeeController { 
   
  @Autowired 
  private EmployeeService employeeServiceImpl; 
   
  @RequestMapping("/deldept.html/{deptId}") 
  public String deleteRecord...