How to map permissions to roles through PermissionsAllowed and @RolesAllowed annotations

the guides:security-authorize-web-endpoints-reference

    @PermissionsAllowed(value = {"create", "update"}, inclusive=true) 
    @POST
    @Path("/modify/inclusive")
    public String createOrUpdate(Long id) {
        return id + " modified";
    }

    @PermissionsAllowed({"see:detail", "see:all", "read"}) 
    @GET
    @Path("/id/{id}")
    public String getItem(String id) {
        return "item-detail-" + id;
    }

quarkus.http.auth.policy.role-policy1.permissions.user=see:all                                      
quarkus.http.auth.policy.role-policy1.permissions.admin=create,update,read                          
quarkus.http.auth.permission.roles1.paths=/crud/modify/*,/crud/id/*                                 
quarkus.http.auth.permission.roles1.policy=role-policy1

Add permission see with action all to SecurityIdentity that holds role user. Similarly as for @PermissionsAllowed annotation, io.quarkus.security.StringPermission is used by default.
Permissions create, update and read are mapped to the role admin.

The guides say that permissions can be mapped to roles,

But when I use both @PermissionsAllowed and @RolesAllowed annotations to achieve the same function, a program error occurs. This confuses me, why using the configuration file works fine, but using the annotation gives an error

Can anyone tell me how to use annotations to achieve the same effect in guides

code and error:

public class ReadyResource {
  @Inject private ApplicationConfig applicationConfig;


  @GET()
  @Path("ready2")
  @PermissionsAllowed("read")
  @RolesAllowed("User")
  @Produces(MediaType.APPLICATION_JSON)
  public Result<ApplicationConfig> getReady2() {
    return Result.ofSuccess(applicationConfig);
  }
}

2023-05-14 13:19:05,464 ERROR [io.qua.dep.dev.IsolatedDevModeMain] (main) Failed to start quarkus: java.lang.RuntimeException: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
	[error]: Build step io.quarkus.security.deployment.SecurityProcessor#gatherSecurityChecks threw an exception: java.lang.IllegalStateException: Method hello of class org.acme.GreetingResource2 is annotated with multiple security annotations
	at io.quarkus.security.deployment.PermissionSecurityChecks$PermissionSecurityChecksBuilder.gatherPermissionsAllowedAnnotations(PermissionSecurityChecks.java:216)
	at io.quarkus.security.deployment.SecurityProcessor.gatherSecurityAnnotations(SecurityProcessor.java:673)
	at io.quarkus.security.deployment.SecurityProcessor.gatherSecurityChecks(SecurityProcessor.java:527)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
	at java.base/java.lang.reflect.Method.invoke(Method.java:578)
	at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:909)
	at io.quarkus.builder.BuildContext.run(BuildContext.java:282)
	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at java.base/java.lang.Thread.run(Thread.java:1623)
	at org.jboss.threads.JBossThread.run(JBossThread.java:501)

+1 to Sergey comment

> But when I use both @PermissionsAllowed and @RolesAllowed annotations to achieve the same function, a program error occurs. This confuses me, why using the configuration file works fine, but using the annotation gives an error

You didn't share error message, but I am pretty sure it is validation error you see and it comes from fact that security annotations like @PermissionsAllowed, @RolesAllowed and others can't be combined on the same method or class.

> This confuses me, why using the configuration file works fine, but using the annotation gives an error. Can anyone tell me how to use annotations to achieve the same effect in guides

Currently there is no way to map roles to permissions via annotations, you can always open issue in Quarkus project. Annotations are there to say this method/class should be secured, let's have a look at their JavaDoc that goes into detail

• https://github.com/jakartaee/common-annotations-api/blob/master/api/src/main/java/jakarta/annotation/security/RolesAllowed.java
• https://github.com/quarkusio/quarkus-security/blob/main/src/main/java/io/quarkus/security/PermissionsAllowed.java

As long as @RolesAllowed is not used in combination with other security annotations on the same method or class, everything works fine

This restriction is just too inconvenient.

@Path("/hello1")
@RolesAllowed("user")
public class GreetingResource1 {
    @GET
    /**
     * work properly
     */
    @PermissionsAllowed("see:read")
    @Produces(MediaType.TEXT_PLAIN)
    public String hello() {
        return "Hello RESTEasy";
    }
}

I don't seem to be reputable enough to add comment :-), so I'll answer you JackyAnn here:

> As long as @RolesAllowed is not used in combination with other security annotations on the same method or class, everything works fine

> This restriction is just too inconvenient.

>

@Path("/hello1")
@RolesAllowed("user")
public class GreetingResource1 {
    @GET
    /**
     * work properly
     */
    @PermissionsAllowed("see:read")
    @Produces(MediaType.TEXT_PLAIN)
    public String hello() {
        return "Hello RESTEasy";
    }
}

your example won't work either as only @PermissionsAllowed is applied, not @RolesAllowed, this behavior follows Jakarta documented behavior https://github.com/jakartaee/common-annotations-api/blob/0e6318ac2716c463b33cceff191c9639c73e80ca/api/src/main/java/jakarta/annotation/security/RolesAllowed.java#L29 that If applied at both the class and methods level, the method value overrides the class value if the two conflict.

Currently, you have 3 options:

• use only @RolesAllowed
• use only @PermissionsAllowed and map roles to permissions (permissions are somehow more volatile and you can have different mapping for roles <-> permissions per each app instance)
• combine HTTP Roles Security Policy where you specify required role and @PermissionsAllowed where you specify required permission (that example is also in Quarkus doc)

And I hear you about inconvenience, but that's matter of opinion.