Question

I’m using Grails 2.0.3 and the latest Spring Security Plugin to secure my controllers.

But somehow controllers are not secured.

import grails.plugins.springsecurity.Secured

@Secured("ROLE_USER")
class SettingsController extends UtilController {
  def index(){
    render "should not run while not logged in"
  }
}

When I am and am not logged in, I see the message. If I inject springSecurityService, it shows the correct logged in status (true/false), so the annotation is just not handled.

I’ve tried to add “IS_AUTHENTICATED_FULLY” requirement and to move annotation to method, it doesn’t help.

What could it be related with?

Answer 1

@Secured annotation accept list of roles (String[]), and I guess you have a problem with converting a string to a array of strings.

Can you try with @Secured(["ROLE_USER"])?