Azure应用角色下request.isUserInRole失效，求JSP角色判断方案

在Azure双因素认证场景下，Spring方法可通过@PreAuthorize("hasAuthority('APPROLE_Admin')")正常实现权限控制，但JSP/JSTL中调用request.isUserInRole("APPROLE_Admin")始终返回false；而传统AD认证中，request.isUserInRole("ROLE_Admin")能正常判断角色，需实现JSP/JSTL中Azure应用角色的判断逻辑，以此控制页面元素显隐。

1. 配置Spring Security映射Azure角色 #

Azure AD返回的应用角色默认以APPROLE_为前缀，但HttpServletRequest的isUserInRole方法默认仅识别ROLE_前缀的角色。需在Spring Security配置中显式映射Azure角色，确保其能被HttpServletRequest识别：

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.oauth2Login()
            .userInfoEndpoint()
            .userAuthoritiesMapper(userAuthoritiesMapper());
    }

    private OAuth2UserAuthoritiesMapper userAuthoritiesMapper() {
        return (authorities, user) -> {
            Set<GrantedAuthority> mappedAuthorities = new HashSet<>();
            
            authorities.forEach(authority -> {
                String authValue = authority.getAuthority();
                mappedAuthorities.add(new SimpleGrantedAuthority(authValue));
                // 可选：同时添加ROLE_前缀的映射，兼容request.isUserInRole判断
                if (authValue.startsWith("APPROLE_")) {
                    mappedAuthorities.add(new SimpleGrantedAuthority("ROLE_" + authValue.substring(8)));
                }
            });
            
            return mappedAuthorities;
        };
    }
}

配置后，即可在JSP中通过request.isUserInRole("ROLE_Admin")判断Azure应用角色，或直接使用原APPROLE_Admin前缀通过Spring Security上下文判断。

2. 直接用Spring Security标签库判断 #

在JSP中引入Spring Security标签库，直接基于权限判断页面元素：

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

<sec:authorize access="hasAuthority('APPROLE_Admin')">
    <!-- 仅管理员可见的元素 -->
    <button class="admin-btn">管理后台</button>
</sec:authorize>

3. 手动遍历权限集合判断 #

若不想依赖标签库，可通过SecurityContextHolder手动获取用户权限并判断：

<%@ page import="org.springframework.security.core.context.SecurityContextHolder" %>
<%@ page import="org.springframework.security.core.GrantedAuthority" %>

<%
boolean isAdmin = false;
var auth = SecurityContextHolder.getContext().getAuthentication();
if (auth != null) {
    for (GrantedAuthority authority : auth.getAuthorities()) {
        if ("APPROLE_Admin".equals(authority.getAuthority())) {
            isAdmin = true;
            break;
        }
    }
}
%>

<% if (isAdmin) { %>
    <div class="admin-section">管理员专属区域</div>
<% } %>

4. 自定义EL函数简化JSTL判断 #

创建自定义EL函数，让JSTL判断更简洁：

1. 编写工具类：

package com.example.utils;

import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.GrantedAuthority;

public class SecurityELUtils {
    public static boolean hasAuthority(String authority) {
        var auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null) return false;
        return auth.getAuthorities().stream()
                .anyMatch(a -> authority.equals(a.getAuthority()));
    }
}

2. 在WEB-INF下创建tld文件（如security-el.tld）：

<?xml version="1.0" encoding="UTF-8"?>
<taglib xmlns="http://java.sun.com/xml/ns/javaee"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-jsptaglibrary_2_1.xsd"
        version="2.1">
    <tlib-version>1.0</tlib-version>
    <short-name>sec-el</short-name>
    <uri>http://example.com/security-el</uri>
    
    <function>
        <name>hasAuthority</name>
        <function-class>com.example.utils.SecurityELUtils</function-class>
        <function-signature>boolean hasAuthority(java.lang.String)</function-signature>
    </function>
</taglib>

3. 在JSP中引用并使用：

<%@ taglib prefix="sec-el" uri="http://example.com/security-el" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

<c:if test="${sec-el:hasAuthority('APPROLE_Admin')}">
    <div class="admin-toolbar">管理员工具栏</div>
</c:if>

HttpServletRequest.isUserInRole()方法默认仅识别以ROLE_为前缀的角色，而Azure AD返回的应用角色前缀为APPROLE_，因此直接调用会返回false。通过Spring Security配置映射角色，或直接基于Spring Security上下文判断权限，即可解决该问题。

内容的提问来源于stack exchange，提问作者Bruno Genovese