Our latest software project used CAS for authentication and single sign-on. I couldn't find any good documentation on how Spring Security and CAS played together. There is some documentation about how to configure your application to use CAS but not much on what messages go back and forth by whom and when.

Recently I was tasked with adding data security to an existing application. The security rules were complex, users within the same user role were supposed to be able to view and edit data differently. I decided to implement this task with a permissions based system whereby users were grouped into roles and each role had a certain set of permissions. Here's how I implemented the solution using Spring and Hibernate...