It would be great if Acegi would support hierarchical role models (e. g. like the SAP R/3 role model). This would make the access rule definitions more elegant and more powerful.

Consider the following example using Acegi's standard RoleVoter (background: every user that is logged in should be able to log out):

/logout.html=ROLE_ADMIN,ROLE_A,ROLE_B,ROLE_AUTHENTICATED

With HierarchicalRoleVoter this can now be shortened to:

/logout.html=ROLE_AUTHENTICATED

I'm attaching a prototype for supporting hierarchical roles (File: mm.zip) that contains a class for the easy definition of hierarchical role models and a cooperating class HierarchicalRoleVoter which can be used as drop-in replacement for Acegi's RoleVoter.

It would be configured like this:

<bean id="roleHierarchy" class="mm.roles.RoleHierarchy" >
<property name="rolePrefix">
<value>ROLE_</value>
</property>
<property name="roles">
<value>
ROLE_UNAUTHENTICATED
ROLE_AUTHENTICATED
ROLE_A
ROLE_B
ROLE_ADMIN
</value>
</property>
<property name="hierarchy">
<value>
ROLE_A > ROLE_B
ROLE_B > ROLE_AUTHENTICATED
ROLE_ADMIN > ROLE_AUTHENTICATED
ROLE_AUTHENTICATED > ROLE_UNAUTHENTICATED
</value>
</property>
</bean>

<bean id="roleVoter" class="mm.roles.HierarchicalRoleVoter" >
<property name="roleHierarchy">
<ref bean="roleHierarchy"/>
</property>
</bean>

Hint: Read the ">" character in the hierarchy definition as "includes".

Since Acegi's authz JSP taglib currently doesn't support hierarchical roles, you would need to write something like this:

<%@ page import="org.acegisecurity.Authentication" %>
<%@ page import="org.acegisecurity.context.SecurityContextHolder" %>
<%@ page import="org.springframework.web.context.support.WebApplicationContextUtils" %>
<%@ page import="mm.roles.RoleHierarchy" %>
 
<% RoleHierarchy roleHierarchy = (RoleHierarchy) WebApplicationContextUtils.getWebApplicationContext(getServletContext()).getBean("roleHierarchy"); %>
<% Authentication auth = SecurityContextHolder.getContext().getAuthentication(); %>

       <% if (roleHierarchy.userHasRole(auth, "ROLE_A")) {%>
You have ROLE_A!
<% } %>