Getting started with Grails Spring Security Core and Spring Security UI
These are two separate plug-ins with volumes of somewhat readable documentation
here and
here. See this
YouTube video that provides a walk-thru using below syntax.
First things first: Start a new project
Installing Security Core:
1) Open conf > BuildConfig.groovy
2) Add compile ":spring-security-core:2.0-RC5" to the plugins area
3) Refresh dependencies by ALT+G R //this installs the security core
4) Open the command history
Type: s2-quickstart com.domain.auth User Role
At this point you have Role, User, and UserRole domain classes
Configuring Security Core:
1) Go to the bottom of config.groovy, you should see some configuration lines for spring security. This is where we define which roles have access to specific pages. We will get into roles in the Configuring Spring Security UI section.
2) Add the following above staticRules:
grails.plugin.springsecurity.logout.postOnly = false// allows logout to work
3) Add the following to your staticRules:
'/dbconsole/**': ['ROLE_ADMIN'],
'/plugins/**': ['ROLE_USER']
4) Open bootstrap.groovy and do this:
import com.domain.auth.*
class BootStrap {
def init = { servletContext ->
def adminRole = Role.findOrSaveWhere(authority:'ROLE_ADMIN')
def user = User.findOrSaveWhere(username:'admin',password:'password')
if(!user.authorities.contains(adminRole)){
UserRole.create(user,adminRole,true)
}
}
def destroy = {
}
}
Installing Spring Security UI:
1) Open conf > BuildConfig.groovy
2) Add compile ":spring-security-ui:1.0-RC2" to the plugins area
3) Refresh dependencies by ALT+G R //this installs the security UI
Configuring Spring Security UI
1) Open config.grooy and add additional configuration to staticRules
'/user/**': ['ROLE_ADMIN'],
'/role/**': ['ROLE_ADMIN'],
'/securityInfo/**': ['ROLE_ADMIN'],
'/registationCode/**': ['ROLE_ADMIN'],
2) Run your app (note this is the first time running your app)
It’s time to create another role, and add a few users, using the Security UI. We will use the admin account we bootstrapped to create the other users and roles. If you want your users to stick around in the database you should open dataSource.groovy and set your dev environment to ‘”update”’ and remove the mem: tag.
3) Click on your User Controller, (all controller code can found within the plugins directory )
4) Add ROLE_USER give this role to your admin account
5) Experiment with the UI
Now go build your app!!
PS: Some Useful Customizations
If you don’t want to use the staticRules area or want to override some security you can use the @Secured tag above each method(). See below.
import grails.plugin.springsecurity.annotation.Secured ///don’t forget to import this
...
@Secured ('ROLE_ADMIN') //talking about this
def yourMethod() {
Your method code
}
...
@Secured ('ROLE_USER')
def yourOtherMethod() {
Your method code
}
...
Who’s logged in? Paste this into the bottom of views > layouts > main.gsp (above </body>)
<nobr>
<div id='loginLinkContainer'>
<sec:ifLoggedIn>
Logged in as <sec:username /> (<g:link controller='logout'>Logout</g:link>)
</sec:ifLoggedIn>
<sec:ifNotLoggedIn>
<g:link controller='login'>Login</g:link>
</sec:ifNotLoggedIn>
<sec:ifSwitched>
<a href='${request.contextPath}/j_spring_security_exit_user'>
Resume as <sec:switchedUserOriginalUsername />
</a>
</sec:ifSwitched>
</div>
</nobr>
</span>
Syntax in views for current user: <sec:username />
Syntax in controllers for current user is a little more complicated:
def springSecurityService // first you have to define the service
springSecurityService.getCurrentUser() // then you can reference it
If you customize your User domain class, you will also want to customize your User create UI form:
Plugins > spring-security-ui > views > user > create.gsp and edit.gsp
The UI also has user registration and forgot password configuration that we did not use.
This is an example of controller code that limits current user to the index view:
def springSecurityService // you have to put this someplace in your controller once!
def index() {
def user = User.findByUsername(params.id) //sends only user related address to view
def loggedInUser = springSecurityService.getCurrentUser();
if (user == loggedInUser) { //user matches loggedInUser
[ user : user ]
} else {
response.sendError(404)
}
}
That's all folks.
