apache / apache/grails-core

CAS configuration once loaded overrides the other application configuration

Open
#15,919 1 comment 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

The code in SpringSecurityCasGrailsPlugin - loads "**DefaultCasSecurityConfig**"
```
`SpringSecurityUtils.loadSecondaryConfig 'DefaultCasSecurityConfig'
// have to get again after overlaying DefaultCasSecurityConfig
conf = SpringSecurityUtils.securityConfig

if (!conf.cas.active) {
return
}`
```
And in "**DefaultCasSecurityConfig**" there are default CAS configuration which are now loaded whenever the Plugin is included irrespective the active flag is true of false.

In similar line there is SAML plugin **SpringSecuritySamlGrailsPlugin**. The above mentioned code is commented.

Code in the CAS plugin need to be commented too. This will ensure that default CAS configuration wouldn't be loaded by default whenever this plugin is included.

Contributor guide

Open the contributing guide

Research direction

Start in SpringSecurityCasGrailsPlugin and compare its configuration handling with SpringSecuritySamlGrailsPlugin. Trace when DefaultCasSecurityConfig is loaded relative to the CAS active flag; done means inactive CAS configuration is not loaded merely because the plugin is included.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.