title: Spring: Roles, authorities and permissions for entities
body: <p>Good afternoon.
  How can I configure permissions and roles for a user relative to a specific controller for a specific entity (something similar to RBAC/ABAC) within one application without usage of different OAUTH2 services?</p>
  
  <p>Example:</p>
  
  <p>App has <strong>global USER roles: ROLE_USER, ROLE_ADMIN</strong>.</p>
  
  <p>Also there's entity named <strong>Project</strong>. There may be many Projects that USER may be a member of. 
  There're some <strong>Project USER roles: PROJECT_ADMIN, PROJECT_EDITOR, PROJECT_USER</strong>.
  Each project role can have their own permissions (authorities) like add user to project, edit project and so on. All role configs are stored in 'project_roles' and 'project_permissions' tables.</p>
  
  <p>As I understood it can be implemented through PreAuthorize annotation, but how can current global user be matched to project role?</p>
  
  <pre><code>@PreAuthorize("@projectService.hasPermission('create_project', #projectEditRequest.id)") // How to pass GlobalUserID?
  @PostMapping
  public ProjectDto create(@RequestBody @Validated ProjectEditRequest projectEditRequest) {
     ...
     ...
  }
  
  </code></pre>
  
  <p>Maybe there're examples of such case implementation?</p>
  
  <p>Thanks in advance!</p>
  
  <p>Analog questions: </p>
  
  <p><a href="https://stackoverflow.com/questions/53395662/spring-boot-security-roles-per-entity">Spring boot security roles per entity</a></p>
  
  <p><a href="https://stackoverflow.com/questions/61317648/roles-connected-with-entities-in-java-spring">Roles connected with entities in Java Spring</a> (without answer)</p>