Custom RolesAllowed like annotation

emito.khoza · September 29, 2025, 12:57pm

Hello, I’d to ask how to create an annotation that can be seen by Vaadin. I have created an Annotation called CustomRolesAllowed that is annotated with PreAuthorize. However, this annotation only works if annotated with @PermitAll and without it I get the error. How can I make this CustomRolesAllowed to work by itself

I am getting the following error:
Reason: Consider adding one of the following annotations to make the view accessible: AnonymousAllowed, PermitAll, RolesAllowed.

knoobie · September 29, 2025, 1:15pm

Create your own AccessAnnotationChecker so that the framework can pick it up and use it

SimonMartinelli · September 29, 2025, 4:19pm

You cannot use Spring Security annotations. Only the listed ones

Tatu2 · September 30, 2025, 7:16am

Annotations do not work by themselves alone as they are just markers, that require some logic somewhere in your application that is able to read the annotations from the class and then do something.

For example I have a vanilla Vaadin 8 demo application here (no Spring or anything), I define custom annotation like

github.com

TatuLund/vaadin-create23/blob/master/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/auth/RolesPermitted.java

package org.vaadin.tatu.vaadincreate.auth;

import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

import org.vaadin.tatu.vaadincreate.backend.data.User.Role;

/**
 * Defines roles that are permitted to access the view.
 */
@Documented
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.TYPE)
public @interface RolesPermitted {

    Role[] value();
}

I set global before view change listener (equivalent to global beforeEnter in Flow) vaadin-create23/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/AppLayout.java at master · TatuLund/vaadin-create23 · GitHub

And then I read the annotation from the target class of the navigation and do things accordingly

github.com

TatuLund/vaadin-create23/blob/master/vaadincreate-ui/src/main/java/org/vaadin/tatu/vaadincreate/AppLayout.java#L182


      
              });
          }
          
          // Check if the view has @AccessAllowed annotation. If the annotation exists
          // grant the access based on it.
          private boolean hasAccessToView(Class<? extends View> view) {
              var allPermitted = view.getAnnotation(AllPermitted.class);
              if (allPermitted != null) {
                  return true;
              }
              var rolePermitted = view.getAnnotation(RolesPermitted.class);
              if (rolePermitted != null) {
                  boolean canAccess = false;
                  for (Role role : rolePermitted.value()) {
                      if (accessControl.isUserInRole(role)) {
                          canAccess = true;
                          break;
                      }
                  }
                  if (!canAccess) {
                      logger.warn("User '{}' has no permission to view '{}'",

This is not Vaadin specific thing, but how Java language works with annotations.

Some frameworks, especially Spring, contain huge amount of this kind of logic behind the annotations, and that is what makes Spring work.