---
schema_version: "1"
id: 6f78aee00e43ac291a59137f1e5eda977f30b0bfb4d5e889cc273669b848c096
title: Component Authorization Using Spring Security
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-runtime/4.11/component-authorization-using-spring-security.md
canonical_url: https://docs.mulesoft.com/mule-runtime/4.11/component-authorization-using-spring-security
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 9c305b9f04730a92fc8efb9dfda564879cd84b5b8fe428ec2c3d7f67b3202019
description: MuleSoft Documentation Site
release: "4.11"
latest: false
---
---
product: Mule Runtime
version: 4.11
keywords: authorization, spring, spring security
---

# Component Authorization Using Spring Security

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Learn how to configure authorization using Spring Security features on your Mule components, so that
users with different roles can only invoke certain methods.

## Configure Spring Security Authentication Manager

The Spring Security interface Authentication Manager is responsible for passing requests through a
chain of Authentication Provider objects. To secure calls to flow components, you must add the
configured `authenticationManager` to the application context.

The following example defines roles with different levels of access to protected processors:

```xml
  <ss:authentication-manager alias="authenticationManager">
    <ss:authentication-provider>
      <ss:user-service id="userService">
        <ss:user name="admin" password="admin" authorities="ROLE_ADMIN" />
        <ss:user name="joe" password="secret" authorities="ROLE_ADMIN" />
        <ss:user name="anon" password="anon" authorities="ROLE_ANON" />
        <ss:user name="user" password="password" authorities="ROLE_ANON" />
        <ss:user name="ross" password="ross" authorities="ROLE_ANON" />
        <ss:user name="marie" password="marie" authorities="ROLE_ANON" />
      </ss:user-service>
    </ss:authentication-provider>
  </ss:authentication-manager>
```

The following example references the previously defined `authenticationManager` to allow only users
with `ROLE_ADMIN` roles in the `requiredAuthorities` field to access the operation:

```xml
	<spring:security-manager>
		<spring:delegate-security-provider name="memory-provider" delegate-ref="authenticationManager" />
	</spring:security-manager>

	<flow name="protectedFlow">
		<http:listener doc:name="Listener" config-ref="HTTP_Listener_config" path="/" />
		<http:basic-security-filter doc:name="Basic security filter" realm="mule" />
		<spring:authorization-filter requiredAuthorities="ROLE_ADMIN" />

		<ee:transform doc:name="Transform Message">
			<ee:message>
				<ee:set-payload><![CDATA[%dw 2.0
				output application/json
				---
				{
					"status": "ok"
				}]]>
				</ee:set-payload>
			</ee:message>
		</ee:transform>
	</flow>
```

## Configure Secure Components in Asynchronous Systems

Spring Security is useful for asynchronous systems because to set the authentication on more than
one thread you have to add a security property to the security provider. In the following example,
the value `MODE_GLOBAL` is the security property added:

```xml
    <mule-ss:security-manager>
        <mule-ss:delegate-security-provider name="memory-dao" delegate-ref="authenticationManager">
            <mule-ss:security-property name="securityMode" value="MODE_GLOBAL"/>
        </mule-ss:delegate-security-provider>
    </mule-ss:security-manager>
```