SecurityLevelVoter.java

public class SecurityLevelVoter implements AccessDecisionVoter {

    private String securityLevelPrefix = "SECURITY_LEVEL_";

    public int vote(Authentication authentication,
                    Object object,
                    Collection<ConfigAttribute> attributes) {

        int result = ACCESS_ABSTAIN;
        Object principal = authentication.getPrincipal();
        for (ConfigAttribute attribute : attributes) {
            if (this.supports(attribute)) {
                result = ACCESS_DENIED;

                if (principal instanceof MyPrincipal) {
                    int requiredSecurityLevel = getRequiredSecurityLevel(attribute);
                    int securityLevel = getUserSecurityLevel((MyPrincipal) principal);
                    if (securityLevel >= requiredSecurityLevel) {
                        return ACCESS_GRANTED;
                    }
                }
            }
        }
        return result;
    }

    private int getRequiredSecurityLevel(ConfigAttribute attribute) {
        String requiredSecurityLevel =
            removeStart(attribute.getAttribute(), securityLevelPrefix);
        return toInt(requiredSecurityLevel, Integer.MAX_VALUE);
    }

    private int getUserSecurityLevel(MyPrincipal principal) {
        return toInt(principal.getSecurityLevel(), Integer.MIN_VALUE);
    }
// ...
}