Spring Security Role Hierarchy not working using Java Config

Note: The accepted answer won't work in the newest version of Spring security (I think since release 5.2.1). This is because the 'and' (ROLE_1 > ROLE_2 and ROLE_2 > ROLE_3) notation was never an official standard. You could have written every word instead of 'and' and it would still work the same in the past versions.

Instead, in the new version you should now use '\n' (new line), e.g. ROLE_1 > ROLE_2\nROLE2 > ROLE_3 ...

For me the solution was having proper bean name for the instance of DefaultWebSecurityExpressionHandler. The name should be webSecurityExpressionHandler.

@Bean
public RoleHierarchyImpl roleHierarchy() {
    RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
    roleHierarchy.setHierarchy(Roles.getRoleHierarchy());
    return roleHierarchy;
}

@Bean
public DefaultWebSecurityExpressionHandler webSecurityExpressionHandler() {
    DefaultWebSecurityExpressionHandler expressionHandler = new DefaultWebSecurityExpressionHandler();
    expressionHandler.setRoleHierarchy(roleHierarchy());
    return expressionHandler;
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .expressionHandler(webSecurityExpressionHandler())
            ...
}

Everytime I want to implement a hierarchy of roles with Spring Security and Java config, I use the following approach:

1. We have to add a RoleHierarchyImpl bean into context (You see, that I use multiple roles to build a hierarchy):

   @Bean
   public RoleHierarchyImpl roleHierarchy() {
       RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
       roleHierarchy.setHierarchy("ROLE_ADMIN > ROLE_DBA ROLE_DBA > ROLE_USER ");
       return roleHierarchy;
   }
   

2. Then we need to create web expression handler to pass obtained hierarchy to it:

   private SecurityExpressionHandler<FilterInvocation> webExpressionHandler() {
       DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
       defaultWebSecurityExpressionHandler.setRoleHierarchy(roleHierarchy());
       return defaultWebSecurityExpressionHandler;
   }
   

3. The final step is to add expressionHandler into http.authorizeRequests():

           @Override
           protected void configure(HttpSecurity http) throws Exception {
               http
                  .authorizeRequests()
                       .expressionHandler(webExpressionHandler())
                       .antMatchers("/admin/**").access("(hasRole('ROLE_ADMIN') or hasRole('ROLE_DBA')) and isFullyAuthenticated()")
                       .antMatchers("/dba").access("hasRole('ROLE_DBA') and isFullyAuthenticated()")
                       .antMatchers("/dba/**").access("hasRole('ROLE_USER')")
                       .and()
                  .requiresChannel()
                       .antMatchers("/security/**").requiresSecure()
                       .anyRequest().requiresInsecure()
                       .and()
                  .formLogin()
                       .loginPage("/login")
                       .failureUrl("/login?auth=fail")
                       .usernameParameter("username")
                       .passwordParameter("password")
                       .defaultSuccessUrl("/admin")
                       .permitAll()
                       .and()
                  .logout()
                           .logoutUrl("/logout")
                           .deleteCookies("remember-me")
                           .invalidateHttpSession(true)
                           .logoutSuccessUrl("/index")
                           .permitAll()
                           .and()
                  .csrf()
                           .and()
                  .rememberMe().tokenValiditySeconds(1209600)
                           .and()
                  .exceptionHandling().accessDeniedPage("/403")
                           .and()
                  .anonymous().disable()
                  .addFilter(switchUserFilter());
           }
   

Result: in this particular example we try to visit /dba section after we have logged in using admin user (ROLE_ADMIN). Before we created a hierarchy, we had an access denied result, but now we can visit this section without any problems.

The issue is in the RoleHierachy, which should be like this:

@Bean
public RoleHierarchy roleHierarchy() {
  RoleHierarchyImpl r = new RoleHierarchyImpl();
  r.setHierarchy("ROLE_ADMIN > ROLE_STAFF and ROLE_ADMIN > ROLE_DEVELOPER and ROLE_STAFF > ROLE_USER and ROLE_DEVELOPER > ROLE_USER");
  return r;
}

keep calling setHierarchy() will override the setting before