Question

I have a controller like this

class MyController {

    def index() {    }
    def list(Integer max) {      }
    def create() {     }
}

I have different roles like “Admin”,”User”
and I want that only “Admin” see the “create” View. knowing that i use Spring Security

Answer 1

The documentation is very clear on how to approach this. Using either Requestmap via the Database for locking down URLs or by using Annotations.

If you’re using the Requestmap you simply need to lock down the URL for a specific set of roles. If you wanted to lock down MyController where create view was only available to an admin, it would be

configAttribute: ROLE_ADMIN   url: /myController/create/**

If using Annotations it would be

class MyController {
    @Secured(['ROLE_ADMIN'])
    def create() { }
}

Read the very well written documentation for more information.