Security with Spring Security Plugin

Spring Security in Grails

The Spring Security Core plugin is the standard way to add authentication and authorization to Grails applications. It integrates seamlessly with Grails controllers and services.

Installation

// build.gradle
plugins {
    id "org.grails.spring-security-core" version "4.0.0"
}

Domain Classes

class User {
    String username
    String password
    boolean enabled = true

    static mapping = {
        table 'sec_user'
    }
}

class Role {
    String authority

    static mapping = {
        table 'sec_role'
    }
}

class UserRole {
    User user
    Role role

    static mapping = {
        table 'sec_user_role'
        id composite: ['user', 'role']
    }
}

Securing Controllers

import grails.plugin.springsecurity.annotation.Secured

@Secured('ROLE_ADMIN')
class AdminController {
    def index() { }
}

class BookController {
    @Secured(['ROLE_USER', 'ROLE_ADMIN'])
    def list() { }

    @Secured('ROLE_ADMIN')
    def delete() { }
}

Configuration

// grails-app/conf/application.groovy
springsecurity {
    userLookup.userDomainClassName = 'com.example.User'
    userLookup.authorityJoinClassName = 'com.example.UserRole'
    userLookup.authority.className = 'com.example.Role'
    loginFormUrl = '/login/auth'
    successHandler.defaultTargetUrl = '/book/list'
}

Key Points

• Spring Security Core is the standard authentication plugin.
• Use @Secured annotation to protect controller actions.
• Domain classes represent users, roles, and their relationships.
• Configuration defines login URLs and default redirect paths.
• The plugin provides built-in login/logout controllers.