title: Dynamic Role Hierarchy in Spring Security
body: <p>I can't believe all I find to define role hierarchies is some strange .xml notation of ">" assignments. There has to be a way to create a RoleHierarchy object from a database defined role hierarchy.. ?!</p>
  
  <p>I'm thinking of a table that has the columns:</p>
  
  <ul>
  <li>role_id</li>
  <li>child_role_id</li>
  </ul>
  
  <p>defining a many-to-many relationship between Role and Role saying: which role has which children? I think I'd prefer children over parents as that's the way the hierarchy is set up in those .xml files: ADMIN > USER, USER > VISITOR.</p>
  
  <p>(This by the way makes me wonder if the standard implementation also supports things like ADMIN > USER, VISITOR meaning USER and VISITOR are "on the same level".)</p>
  
  <p>Now if I want to call </p>
  
  <pre><code>roleHierarchy.getReachableGrantedAuthorities(authentication.getAuthorities()));
  </code></pre>
  
  <p>I need a RoleHierarchy Implementation object. spring-security provides one but the setter accepts only this weird string representation. I don't really want to transform my database results into a string representation but rather work with some kind of tree structure. </p>
  
  <p>So the only way seems to be extending the Implementation and writing my own setter to work with my database result set to build the <code>rolesReachableInOneStepMap</code> and <code>rolesReachableInOneOrMoreStepMap</code>.</p>
  
  <p>Or does anyone know of a different solution?</p>
  
  <p>Thanks for any pointers or confirmation!</p>