title: Allowing access for specific users in Spring Security
body: <p>I'm using Spring Security to Secure my Web App.
  I have a page where I show <code>foo</code> objects for administrators.</p>
  
  <pre><code>&lt;intercept-url pattern="/show_foo/**" access="hasRole('ROLE_ADMIN')" /&gt;
  </code></pre>
  
  <p>But now I have a requirement that a <code>foo</code> cannot be seen by all the Administrators, for example only administrators with city="New York" can access to the element.</p>
  
  <p>I've did something in my controller to solve this :</p>
  
  <pre><code>@RequestMapping(method=RequestMethod.GET,value="/show_foo"
  public ModelAndView showfunction(Principal user)
  {
  User user2 = userService.getUserByName(user.getName());
  if(/* some checks on user2 */)
     /* show page */
  else
    /* show error page*/
  } 
  </code></pre>
  
  <p>So my question is : can I avoid the database call, because I need this almost in all of my pages and I find it ugly to check each time at the top of any controller the same thing over and over. Is there a Spring Security feature for this kind of use cases?.</p>