apache / apache/grails-core

Spring security, hierarchical roles syntax Grails 3 vs Grails 4

Open
#15,892 2 comments 2 reactions 0 assignees View on GitHub
relates-to:spring-security type: bug
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

### Expected Behavior

The role hierarchy relationship is specified by the ">" operator:
```groovy
grails.plugin.springsecurity.roleHierarchy = '''
ROLE_ADMIN>ROLE_USER
'''
```
This simple hierarchy is working on Grails 3. A user with ROLE_ADMIN rol, also have the ROLE_USER rol.

### Actual Behaviour

This hiearchy specification is not working on Grails 4, and it is not giving any warning or error on application bootup.
A user with ROLE_ADMIN only has this role and it is not inheriting the ROLE_USER.

### Steps To Reproduce

You can clone
- https://github.com/fjloma/grails4-spring-security-test to test the Grails 4 failing case
- https://github.com/fjloma/grails3-spring-security-test to thest the Grails 3 working case

If you want to generate the Grails 4 code, follow tutorial https://grails.github.io/grails-spring-security-core/4.0.x/index.html#tutorials until step 26.1.8.8

Change the SecureController class to print the user roles.

`SecureController.groovy`

```groovy
package com.mycompany.myapp

import grails.plugin.springsecurity.annotation.Secured
import org.springframework.security.core.context.SecurityContextHolder

class SecureController {
@Secured('ROLE_ADMIN')
def index() {
render 'Secure access only '+ SecurityContextHolder.getContext().getAuthentication().getAuthorities()
}
}
```

### Test fail
Add the following line to application.groovy a simple role hierarchy. **Note there is no spaces arround the ">" symbol.**

```groovy
grails.plugin.springsecurity.roleHierarchy = '''
ROLE_ADMIN>ROLE_USER
'''
```

Run the application (grails run-app) and go to http://localhost:8080/secure and log with me / password. It shows:
```plain
Secure access only [ROLE_ADMIN]
```
when te expected value should be

```plain
Secure access only [ROLE_USER, ROLE_ADMIN]
```

### Test with spaces
Change the hierarchy configuration on application.groovy to have spaces arround the ">"
```groovy
grails.plugin.springsecurity.roleHierarchy = '''
ROLE_ADMIN > ROLE_USER
'''
```
Run the application (grails run-app) and go to http://localhost:8080/secure and log with me / password. Now it shows the correct values:

```plain
Secure access only [ROLE_USER, ROLE_ADMIN]
```

### Environment Information

- Operating System: Mac OS Monterrey 12.2.1 Apple M1 Max
- Grails Version: 4.0.13
- JVM Version: 1.8.0_312
- Groovy 2.5.14

### Example Application

https://github.com/fjloma/grails4-spring-security-test

### Version

4.0.13

Contributor guide

Open the contributing guide

Research direction

Compare the Grails 3 and Grails 4 example applications, focusing on application.groovy and SecureController.groovy. Start by running the Grails 4 reproduction with the hierarchy both without and with spaces around the ">" operator. Done means the no-space configuration produces [ROLE_USER, ROLE_ADMIN] for the secured endpoint without warnings or errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy, spring
Domain
authorization
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.