# Spring Security Authorization to an url based on Claim Value

**URL:** <https://devforum.okta.com/t/spring-security-authorization-to-an-url-based-on-claim-value/1922>\
**Category:** OAuth/OIDC\
**Tags:** spring, java\
**Created:** [June 7, 2018, 6:13pm UTC](https://devforum.okta.com/t/spring-security-authorization-to-an-url-based-on-claim-value/1922 "2018-06-07T18:13:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marc](https://avatars.discourse-cdn.com/v4/letter/m/8dc957/32.png) [@marc](https://devforum.okta.com/u/marc)\
**Post date:** [June 7, 2018, 6:13pm UTC](https://devforum.okta.com/t/spring-security-authorization-to-an-url-based-on-claim-value/1922/1 "2018-06-07T18:13:30Z")

</div>

HI,  
I am a newbee to Spring Security. I am developing my web app based on OIDC using spring boot.  
i am trying to authorize an url based on the claim value returned from okta. Here is my case.

I have an admin url - /admin, and have a custom claim along with default claims, setup in the okta . I am getting authenticated and after that from the userInfo url I will get the claim values and it contains the list of Groups (Like prov1, prov2, ProvAdmin).  
from the above claim- Groups, I have to authorize the user to my /admin usl if the above list contains ProvAdmin group. so basically if the user contains the group - ProvAdmin, then only the user will be authorized to the /admin url

below is my springSecurity config

@Override  
protected void configure(HttpSecurity http) throws Exception {  
http.authorizeRequests().mvcMatchers("/admin")  
.anyRequest().authenticated()  
.and()  
.oauth2Login()  
.loginPage("/customOAuth2Login\_Okta").permitAll()  
.and()  
.logout()  
.logoutRequestMatcher(new AntPathRequestMatcher("/performLogOut")).permitAll()  
}

any help is appreciated

---

<div class="post-metadata">

**Author:** ![akapoor](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@akapoor](https://devforum.okta.com/u/akapoor)\
**Post date:** [June 8, 2018, 8:45pm UTC](https://devforum.okta.com/t/spring-security-authorization-to-an-url-based-on-claim-value/1922/2 "2018-06-08T20:45:53Z")

</div>

Hi Marc,  
I’ve a similar implementation. on the front end we have a react app, and we use the Okta SignInWidget for the login and store the (JWT) token.

1. On the Okta side we generate the token with the groups claim in it.

2. Under our SPA Okta application sign on setup, I’ve setup a group claim filter under OpenID Connect ID Token.

3. That claim token is named as authorities (instead of groups). By default Spring Security Oauth expects that name. but you can customize it.

4. On the Spring boot here’s an example configuration from my project

Hope this helps!  
-Amit

---

<div class="post-metadata">

**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\
**Post date:** [June 25, 2018, 1:56pm UTC](https://devforum.okta.com/t/spring-security-authorization-to-an-url-based-on-claim-value/1922/3 "2018-06-25T13:56:43Z")

</div>

Hey @marc!

The [Okta Spring Boot Starter](https://github.com/okta/okta-spring-boot#configure-your-properties) does this out of the box. By default it uses the `groups` claim, and maps them to Spring Authorities. Similar to waht @akapoor mentioned you can use `.hasAuthority()` or [annotation](https://docs.spring.io/spring-security/site/docs/current/reference/html/el-access.html).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 12, 2024, 10:42pm UTC](https://devforum.okta.com/t/spring-security-authorization-to-an-url-based-on-claim-value/1922/4 "2024-01-12T22:42:52Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.