Spring security, hierarchical roles syntax Grails 3 vs Grails 4
- Dominant language
- Groovy
- Stars
- 2.9k
- Forks
- 975
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 92
Description
### Expected Behavior
The role hierarchy relationship is specified by the ">" operator:
```groovy
grails.plugin.springsecurity.roleHierarchy = '''
ROLE_ADMIN>ROLE_USER
'''
```
This simple hierarchy is working on Grails 3. A user with ROLE_ADMIN rol, also have the ROLE_USER rol.
### Actual Behaviour
This hiearchy specification is not working on Grails 4, and it is not giving any warning or error on application bootup.
A user with ROLE_ADMIN only has this role and it is not inheriting the ROLE_USER.
### Steps To Reproduce
You can clone
- https://github.com/fjloma/grails4-spring-security-test to test the Grails 4 failing case
- https://github.com/fjloma/grails3-spring-security-test to thest the Grails 3 working case
If you want to generate the Grails 4 code, follow tutorial https://grails.github.io/grails-spring-security-core/4.0.x/index.html#tutorials until step 26.1.8.8
Change the SecureController class to print the user roles.
`SecureController.groovy`
```groovy
package com.mycompany.myapp
import grails.plugin.springsecurity.annotation.Secured
import org.springframework.security.core.context.SecurityContextHolder
class SecureController {
@Secured('ROLE_ADMIN')
def index() {
render 'Secure access only '+ SecurityContextHolder.getContext().getAuthentication().getAuthorities()
}
}
```
### Test fail
Add the following line to application.groovy a simple role hierarchy. **Note there is no spaces arround the ">" symbol.**
```groovy
grails.plugin.springsecurity.roleHierarchy = '''
ROLE_ADMIN>ROLE_USER
'''
```
Run the application (grails run-app) and go to http://localhost:8080/secure and log with me / password. It shows:
```plain
Secure access only [ROLE_ADMIN]
```
when te expected value should be
```plain
Secure access only [ROLE_USER, ROLE_ADMIN]
```
### Test with spaces
Change the hierarchy configuration on application.groovy to have spaces arround the ">"
```groovy
grails.plugin.springsecurity.roleHierarchy = '''
ROLE_ADMIN > ROLE_USER
'''
```
Run the application (grails run-app) and go to http://localhost:8080/secure and log with me / password. Now it shows the correct values:
```plain
Secure access only [ROLE_USER, ROLE_ADMIN]
```
### Environment Information
- Operating System: Mac OS Monterrey 12.2.1 Apple M1 Max
- Grails Version: 4.0.13
- JVM Version: 1.8.0_312
- Groovy 2.5.14
### Example Application
https://github.com/fjloma/grails4-spring-security-test
### Version
4.0.13
Contributor guide
Research direction
Compare the Grails 3 and Grails 4 example applications, focusing on application.groovy and SecureController.groovy. Start by running the Grails 4 reproduction with the hierarchy both without and with spaces around the ">" operator. Done means the no-space configuration produces [ROLE_USER, ROLE_ADMIN] for the secured endpoint without warnings or errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- groovy, spring
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100