java - How to change roles and permissions in runtime in Spring-boot using SpringWebSecurity -

i have same "projects" , same users in database in spring-boot webapp. users access projects using urls like:

 http: // server / project / 1  http: // server / project / 2  ...  http: // server / project / x 

where "x" project id type long.

different users have different privileges projects, eg .:

• user1 has admin role in "project1"
• user2 has user role in "project1"
• user3 has user role in "projec1"
• user1 has user role in "project2"
• user2 has admin role in "project2"
• user3 has user role in "projec2"

some user add new project "project3" , grant access project user1 , user2 user , user3 roles admin role.

in database have table users (user list) , table authorities (privileges of each user) don't know how link privileges, users , "projects".

package pl.pecynki.testapp;  import javax.sql.datasource;  import org.slf4j.logger; import org.slf4j.loggerfactory; import org.springframework.beans.factory.annotation.autowired; import org.springframework.context.annotation.bean; import org.springframework.context.annotation.configuration; import org.springframework.security.config.annotation.authentication.builders.authenticationmanagerbuilder; import org.springframework.security.config.annotation.web.builders.httpsecurity; import org.springframework.security.config.annotation.web.configuration.enablewebsecurity; import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter; import org.springframework.security.web.authentication.authenticationsuccesshandler; import org.springframework.security.web.authentication.simpleurlauthenticationsuccesshandler;  @enablewebsecurity @configuration public class securityconfig extends websecurityconfigureradapter {      logger logger = loggerfactory.getlogger(securityconfig.class);      @autowired     private datasource datasource;      @bean     public authenticationsuccesshandler successhandler() {         simpleurlauthenticationsuccesshandler handler = new simpleurlauthenticationsuccesshandler();         handler.setusereferer(false);         return handler;     }         @override     protected void configure(httpsecurity http) throws exception {          http             .authorizerequests()                 .antmatchers("/project/**")                     .hasrole("user");         http             .authorizerequests()                 .antmatchers("/project/**/edit/")                     .hasrole("admin");         http             .authorizerequests()                 .antmatchers("/project/new")                     .hasrole("superadmin");         http         .authorizerequests()             .antmatchers("/notice_form")                 .authenticated();          http             .authorizerequests()                 .antmatchers("/","/**")                     .permitall();          http             .formlogin()                 .loginpage("/login")                 .usernameparameter("username")                 .passwordparameter("password")                 .successhandler(successhandler());         http             .formlogin()                 .permitall();         http             .logout()                 .permitall();      }      @autowired     public void configureglobal(authenticationmanagerbuilder auth) throws exception {         auth.jdbcauthentication().datasource(datasource)            .usersbyusernamequery("select username,password,enabled users username=?")            .authoritiesbyusernamequery("select username,authority authorities username=?");     }  } 

wiki