Grails Spring Security Plugins - Combined Reference Documentation

./rename_gradle_artifacts.sh -l my/project/location

implementation 'org.apache.grails:grails-spring-security:7.0.2-SNAPSHOT'

./gradlew runCommand -Pargs="s2-quickstart com.yourapp User Role"

./grailsw s2-quickstart com.yourapp User Role

package com.mycompany.myapp

import groovy.transform.EqualsAndHashCode
import groovy.transform.ToString
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@EqualsAndHashCode(includes = 'username')
@ToString(includes = 'username', includeNames = true, includePackage = false)
class User implements Serializable {

	private static final long serialVersionUID = 1

	String username
	String password
	boolean enabled = true
	boolean accountExpired
	boolean accountLocked
	boolean passwordExpired

	Set<Role> getAuthorities() {
		(UserRole.findAllByUser(this) as List<UserRole>)*.role as Set<Role>
	}

	static constraints = {
		password blank: false, password: true
		username blank: false, unique: true
	}

	static mapping = {
		password column: '`password`'
	}
}

package com.mycompany.myapp

import groovy.transform.EqualsAndHashCode
import groovy.transform.ToString
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@EqualsAndHashCode(includes='username')
@ToString(includes='username', includeNames=true, includePackage=false)
class User implements Serializable {

	private static final long serialVersionUID = 1

	String username
	String password
	boolean enabled = true
    String email (1)
    String firstName (1)
    String lastName (1)
	boolean accountExpired
	boolean accountLocked
	boolean passwordExpired

    def someMethod() { (2)
        ...
    }


	Set<Role> getAuthorities() {
		(UserRole.findAllByUser(this) as List<UserRole>)*.role as Set<Role>
	}

	static constraints = {
		password blank: false, password: true
		username blank: false, unique: true
	}

	static mapping = {
		password column: '`password`'
	}
}

package com.mycompany.myapp

import groovy.transform.EqualsAndHashCode
import groovy.transform.ToString
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@EqualsAndHashCode(includes='authority')
@ToString(includes='authority', includeNames=true, includePackage=false)
class Role implements Serializable {

    private static final long serialVersionUID = 1

    String authority

    static constraints = {
        authority blank: false, unique: true
    }

    static mapping = {
        cache true
    }
}

package com.mycompany.myapp

import grails.gorm.DetachedCriteria
import groovy.transform.ToString

import org.codehaus.groovy.util.HashCodeHelper
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@ToString(cache=true, includeNames=true, includePackage=false)
class UserRole implements Serializable {

    private static final long serialVersionUID = 1

    User user
    Role role

    @Override
    boolean equals(other) {
        if (other instanceof UserRole) {
            other.userId == user?.id && other.roleId == role?.id
        }
    }

    @Override
    int hashCode() {
        int hashCode = HashCodeHelper.initHash()
        if (user) {
            hashCode = HashCodeHelper.updateHash(hashCode, user.id)
        }
        if (role) {
            hashCode = HashCodeHelper.updateHash(hashCode, role.id)
        }
        hashCode
    }

    static UserRole get(long userId, long roleId) {
        criteriaFor(userId, roleId).get()
    }

    static boolean exists(long userId, long roleId) {
        criteriaFor(userId, roleId).count()
    }

    private static DetachedCriteria criteriaFor(long userId, long roleId) {
        UserRole.where {
            user == User.load(userId) &&
                    role == Role.load(roleId)
        }
    }

    static UserRole create(User user, Role role, boolean flush = false) {
        def instance = new UserRole(user: user, role: role)
        instance.save(flush: flush)
        instance
    }

    static boolean remove(User u, Role r) {
        if (u != null && r != null) {
            UserRole.where { user == u && role == r }.deleteAll()
        }
    }

    static int removeAll(User u) {
        u == null ? 0 : UserRole.where { user == u }.deleteAll() as int
    }

    static int removeAll(Role r) {
        r == null ? 0 : UserRole.where { role == r }.deleteAll() as int
    }

    static constraints = {
        role validator: { Role r, UserRole ur ->
            if (ur.user?.id) {
                UserRole.withNewSession {
                    if (UserRole.exists(ur.user.id, r.id)) {
                        return ['userRole.exists']
                    }
                }
            }
        }
    }

    static mapping = {
        id composite: ['user', 'role']
        version false
    }
}

User user = ...
Role role = ...
UserRole.create user, role

User user = ...
Role role = ...
UserRole.remove user, role

package com.mycompany.myapp

import grails.gorm.DetachedCriteria
import groovy.transform.ToString

import org.codehaus.groovy.util.HashCodeHelper
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@ToString(cache=true, includeNames=true, includePackage=false)
class RoleGroupRole implements Serializable {

    private static final long serialVersionUID = 1

    RoleGroup roleGroup
    Role role

    @Override
    boolean equals(other) {
        if (other instanceof RoleGroupRole) {
            other.roleId == role?.id && other.roleGroupId == roleGroup?.id
        }
    }

    @Override
    int hashCode() {
        int hashCode = HashCodeHelper.initHash()
        if (roleGroup) {
            hashCode = HashCodeHelper.updateHash(hashCode, roleGroup.id)
        }
        if (role) {
            hashCode = HashCodeHelper.updateHash(hashCode, role.id)
        }
        hashCode
    }

    static RoleGroupRole get(long roleGroupId, long roleId) {
        criteriaFor(roleGroupId, roleId).get()
    }

    static boolean exists(long roleGroupId, long roleId) {
        criteriaFor(roleGroupId, roleId).count()
    }

    private static DetachedCriteria criteriaFor(long roleGroupId, long roleId) {
        RoleGroupRole.where {
            roleGroup == RoleGroup.load(roleGroupId) &&
                    role == Role.load(roleId)
        }
    }

    static RoleGroupRole create(RoleGroup roleGroup, Role role, boolean flush = false) {
        def instance = new RoleGroupRole(roleGroup: roleGroup, role: role)
        instance.save(flush: flush)
        instance
    }

    static boolean remove(RoleGroup rg, Role r) {
        if (rg != null && r != null) {
            RoleGroupRole.where { roleGroup == rg && role == r }.deleteAll()
        }
    }

    static int removeAll(Role r) {
        r == null ? 0 : RoleGroupRole.where { role == r }.deleteAll() as int
    }

    static int removeAll(RoleGroup rg) {
        rg == null ? 0 : RoleGroupRole.where { roleGroup == rg }.deleteAll() as int
    }

    static constraints = {
        role validator: { Role r, RoleGroupRole rg ->
            if (rg.roleGroup?.id) {
                RoleGroupRole.withNewSession {
                    if (RoleGroupRole.exists(rg.roleGroup.id, r.id)) {
                        return ['roleGroup.exists']
                    }
                }
            }
        }
    }

    static mapping = {
        id composite: ['roleGroup', 'role']
        version false
    }
}

Set<RoleGroup> getAuthorities() {
    (UserRoleGroup.findAllByUser(this) as List<UserRoleGroup>)*.roleGroup as Set<RoleGroup>
}

package com.mycompany.myapp

import grails.gorm.DetachedCriteria
import groovy.transform.ToString
import org.codehaus.groovy.util.HashCodeHelper
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@ToString(cache = true, includeNames = true, includePackage = false)
class UserRoleGroup implements Serializable {

    private static final long serialVersionUID = 1

    User user
    RoleGroup roleGroup

    @Override
    boolean equals(other) {
        if (other instanceof UserRoleGroup) {
            other.userId == user?.id && other.roleGroupId == roleGroup?.id
        }
        false
    }

    @Override
    int hashCode() {
        int hashCode = HashCodeHelper.initHash()
        if (user) {
            hashCode = HashCodeHelper.updateHash(hashCode, user.id)
        }
        if (roleGroup) {
            hashCode = HashCodeHelper.updateHash(hashCode, roleGroup.id)
        }
        hashCode
    }

    static UserRoleGroup get(long userId, long roleGroupId) {
        criteriaFor(userId, roleGroupId).get()
    }

    static boolean exists(long userId, long roleGroupId) {
        criteriaFor(userId, roleGroupId).count()
    }

    private static DetachedCriteria criteriaFor(long userId, long roleGroupId) {
        UserRoleGroup.where {
            user == User.load(userId) &&
            roleGroup == RoleGroup.load(roleGroupId)
        }
    }

    static UserRoleGroup create(User user, RoleGroup roleGroup, boolean flush = false) {
        def instance = new UserRoleGroup(user: user, roleGroup: roleGroup)
        instance.save(flush: flush)
        instance
    }

    static boolean remove(User u, RoleGroup rg) {
        if (u != null && rg != null) {
            UserRoleGroup.where { user == u && roleGroup == rg }.deleteAll()
        }
    }

    static int removeAll(User u) {
        u == null ? 0 : UserRoleGroup.where { user == u }.deleteAll() as int
    }

    static int removeAll(RoleGroup rg) {
        rg == null ? 0 : UserRoleGroup.where { roleGroup == rg }.deleteAll() as int
    }

    static constraints = {
        user validator: { User u, UserRoleGroup ug ->
            if (ug.roleGroup?.id) {
                UserRoleGroup.withNewSession {
                    if (UserRoleGroup.exists(u.id, ug.roleGroup.id)) {
                        return ['userGroup.exists']
                    }
                }
            }
        }
    }

    static mapping = {
        id composite: ['roleGroup', 'user']
        version false
    }
}

package com.mycompany.myapp

import grails.gorm.DetachedCriteria
import groovy.transform.ToString

import org.codehaus.groovy.util.HashCodeHelper
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@ToString(cache=true, includeNames=true, includePackage=false)
class RoleGroupRole implements Serializable {

    private static final long serialVersionUID = 1

    RoleGroup roleGroup
    Role role

    @Override
    boolean equals(other) {
        if (other instanceof RoleGroupRole) {
            other.roleId == role?.id && other.roleGroupId == roleGroup?.id
        }
    }

    @Override
    int hashCode() {
        int hashCode = HashCodeHelper.initHash()
        if (roleGroup) {
            hashCode = HashCodeHelper.updateHash(hashCode, roleGroup.id)
        }
        if (role) {
            hashCode = HashCodeHelper.updateHash(hashCode, role.id)
        }
        hashCode
    }

    static RoleGroupRole get(long roleGroupId, long roleId) {
        criteriaFor(roleGroupId, roleId).get()
    }

    static boolean exists(long roleGroupId, long roleId) {
        criteriaFor(roleGroupId, roleId).count()
    }

    private static DetachedCriteria criteriaFor(long roleGroupId, long roleId) {
        RoleGroupRole.where {
            roleGroup == RoleGroup.load(roleGroupId) &&
                    role == Role.load(roleId)
        }
    }

    static RoleGroupRole create(RoleGroup roleGroup, Role role, boolean flush = false) {
        def instance = new RoleGroupRole(roleGroup: roleGroup, role: role)
        instance.save(flush: flush)
        instance
    }

    static boolean remove(RoleGroup rg, Role r) {
        if (rg != null && r != null) {
            RoleGroupRole.where { roleGroup == rg && role == r }.deleteAll()
        }
    }

    static int removeAll(Role r) {
        r == null ? 0 : RoleGroupRole.where { role == r }.deleteAll() as int
    }

    static int removeAll(RoleGroup rg) {
        rg == null ? 0 : RoleGroupRole.where { roleGroup == rg }.deleteAll() as int
    }

    static constraints = {
        role validator: { Role r, RoleGroupRole rg ->
            if (rg.roleGroup?.id) {
                RoleGroupRole.withNewSession {
                    if (RoleGroupRole.exists(rg.roleGroup.id, r.id)) {
                        return ['roleGroup.exists']
                    }
                }
            }
        }
    }

    static mapping = {
        id composite: ['roleGroup', 'role']
        version false
    }
}

package com.mycompany.myapp

import org.springframework.http.HttpMethod

import groovy.transform.EqualsAndHashCode
import groovy.transform.ToString
import grails.compiler.GrailsCompileStatic

@GrailsCompileStatic
@EqualsAndHashCode(includes=['configAttribute', 'httpMethod', 'url'])
@ToString(includes=['configAttribute', 'httpMethod', 'url'], cache=true, includeNames=true, includePackage=false)
class SecurityMapping implements Serializable {

	private static final long serialVersionUID = 1

	String configAttribute
	HttpMethod httpMethod
	String url

	static constraints = {
		configAttribute(blank: false)
		httpMethod(nullable: true)
		url(blank: false, unique: 'httpMethod')
	}

	static mapping = {
		cache(true)
	}
}

grails.plugin.springsecurity.rejectIfNoRule = true
grails.plugin.springsecurity.fii.rejectPublicInvocations = false

grails.plugin.springsecurity.rejectIfNoRule = false
grails.plugin.springsecurity.fii.rejectPublicInvocations = true

grails.plugin.springsecurity.controllerAnnotations.staticRules = [
   [pattern: '/',               access: ['permitAll']],
   [pattern: '/error',          access: ['permitAll']],
   [pattern: '/index',          access: ['permitAll']],
   [pattern: '/index.gsp',      access: ['permitAll']],
   [pattern: '/shutdown',       access: ['permitAll']],
   [pattern: '/assets/**',      access: ['permitAll']],
   [pattern: '/**/js/**',       access: ['permitAll']],
   [pattern: '/**/css/**',      access: ['permitAll']],
   [pattern: '/**/images/**',   access: ['permitAll']],
   [pattern: '/**/favicon.ico', access: ['permitAll']]
]

for (String url in [
      '/', '/error', '/index', '/index.gsp', '/**/favicon.ico', '/shutdown',
      '/**/js/**', '/**/css/**', '/**/images/**',
      '/login', '/login.*', '/login/*',
      '/logout', '/logout.*', '/logout/*']) {
   new Requestmap(url: url, configAttribute: 'permitAll').save()
}
springSecurityService.clearCachedRequestmaps()

grails.plugin.springsecurity.interceptUrlMap = [
   [pattern: '/',               access: ['permitAll']],
   [pattern: '/error',          access: ['permitAll']],
   [pattern: '/index',          access: ['permitAll']],
   [pattern: '/index.gsp',      access: ['permitAll']],
   [pattern: '/shutdown',       access: ['permitAll']],
   [pattern: '/assets/**',      access: ['permitAll']],
   [pattern: '/**/js/**',       access: ['permitAll']],
   [pattern: '/**/css/**',      access: ['permitAll']],
   [pattern: '/**/images/**',   access: ['permitAll']],
   [pattern: '/**/favicon.ico', access: ['permitAll']],
   [pattern: '/login/**',       access: ['permitAll']],
   [pattern: '/logout/**',      access: ['permitAll']]
]

[pattern: '/login/impersonate', access: ['ROLE_ADMIN']],
[pattern: '/logout/impersonate', access: ['permitAll']]

grails.plugin.springsecurity.securityConfigType = "Annotation"

package com.mycompany.myapp

import grails.plugin.springsecurity.annotation.Secured

class SecureAnnotatedController {

   @Secured('ROLE_ADMIN')
   def index() {
      render 'you have ROLE_ADMIN'
   }

   @Secured(['ROLE_ADMIN', 'ROLE_SUPERUSER'])
   def adminEither() {
      render 'you have ROLE_ADMIN or SUPERUSER'
   }

   def anybody() {
      render 'anyone can see this' // assuming you're not using "strict" mode,
                                   // otherwise the action is not viewable by anyone
   }
}

@Secured(closure = {
   assert request
   assert ctx
   authentication.name == 'admin1'
})
def someMethod() {
   ...
}

package com.mycompany.myapp

import grails.plugin.springsecurity.annotation.Secured

@Secured('ROLE_ADMIN')
class SecureClassAnnotatedController {

   def index() {
      render 'index: you have ROLE_ADMIN'
   }

   def otherAction() {
      render 'otherAction: you have ROLE_ADMIN'
   }

   @Secured('ROLE_SUPERUSER')
   def super() {
      render 'super: you have ROLE_SUPERUSER'
   }
}

package com.mycompany.myapp

import grails.plugin.springsecurity.annotation.Secured

class SecureAnnotatedController {

   @Secured(value = ['ROLE_ADMIN'], httpMethod = 'GET')
   def create() {
      ...
   }

   @Secured(value = ['ROLE_ADMIN'], httpMethod = 'POST')
   def save() {
      ...
   }
}

grails.plugin.springsecurity.securityConfigType = "InterceptUrlMap"

grails:
    plugin:
        springsecurity:
            securityConfigType: InterceptUrlMap

grails.plugin.springsecurity.interceptUrlMap = [
   [pattern: '/',               access: ['permitAll']],
   [pattern: '/error',          access: ['permitAll']],
   [pattern: '/index',          access: ['permitAll']],
   [pattern: '/index.gsp',      access: ['permitAll']],
   [pattern: '/shutdown',       access: ['permitAll']],
   [pattern: '/assets/**',      access: ['permitAll']],
   [pattern: '/**/js/**',       access: ['permitAll']],
   [pattern: '/**/css/**',      access: ['permitAll']],
   [pattern: '/**/images/**',   access: ['permitAll']],
   [pattern: '/**/favicon.ico', access: ['permitAll']],
   [pattern: '/login',          access: ['permitAll']],
   [pattern: '/login/**',       access: ['permitAll']],
   [pattern: '/logout',         access: ['permitAll']],
   [pattern: '/logout/**',      access: ['permitAll']]
]

grails:
    plugin:
        springsecurity:
            interceptUrlMap:
                - { pattern: '/',               access: ['permitAll'] }
                - { pattern: '/error',          access: ['permitAll'] }
                - { pattern: '/index',          access: ['permitAll'] }
                - { pattern: '/index.gsp',      access: ['permitAll'] }
                - { pattern: '/shutdown',       access: ['permitAll'] }
                - { pattern: '/assets/**',      access: ['permitAll'] }
                - { pattern: '/**/js/**',       access: ['permitAll'] }
                - { pattern: '/**/css/**',      access: ['permitAll'] }
                - { pattern: '/**/images/**',   access: ['permitAll'] }
                - { pattern: '/**/favicon.ico', access: ['permitAll'] }
                - { pattern: '/login',          access: ['permitAll'] }
                - { pattern: '/login/**',       access: ['permitAll'] }
                - { pattern: '/logout',         access: ['permitAll'] }
                - { pattern: '/logout/**',      access: ['permitAll'] }

grails.plugin.springsecurity.interceptUrlMap = [
   ...
   [pattern: '/secure/**',  access: ['ROLE_ADMIN']],
   [pattern: '/finance/**', access: ['ROLE_FINANCE', 'IS_AUTHENTICATED_FULLY']]
]

grails:
    plugin:
        springsecurity:
            interceptUrlMap:
                - { pattern: '/secure/**',  access: ['ROLE_ADMIN'] }
                - { pattern: '/finance/**', access: ['ROLE_FINANCE', 'IS_AUTHENTICATED_FULLY'] }

[pattern: '/secure/**',               access: ['ROLE_ADMIN', 'ROLE_SUPERUSER']],
[pattern: '/secure/reallysecure/**',  access: ['ROLE_SUPERUSER']]

[pattern: '/secure/reallysecure/**', access: ['ROLE_SUPERUSER']],
[pattern: '/secure/**',              access: ['ROLE_ADMIN', 'ROLE_SUPERUSER']]

grails.plugin.springsecurity.securityConfigType = 'Requestmap'
grails.plugin.springsecurity.requestMap.className = 'com.mycompany.myapp.SecurityMapping'

for (String url in [
      '/', '/error', '/index', '/index.gsp', '/**/favicon.ico', '/shutdown',
      '/assets/**', '/**/js/**', '/**/css/**', '/**/images/**',
      '/login', '/login.*', '/login/*',
      '/logout', '/logout.*', '/logout/*']) {
   new SecurityMapping(url: url, configAttribute: 'permitAll').save()
}

new SecurityMapping(url: '/profile/**',    configAttribute: 'ROLE_USER').save()
new SecurityMapping(url: '/admin/**',      configAttribute: 'ROLE_ADMIN').save()
new SecurityMapping(url: '/admin/role/**', configAttribute: 'ROLE_SUPERVISOR').save()
new SecurityMapping(url: '/admin/user/**',
               configAttribute: 'ROLE_ADMIN,ROLE_SUPERVISOR').save()
new SecurityMapping(url: '/login/impersonate',
               configAttribute: 'ROLE_SWITCH_USER,IS_AUTHENTICATED_FULLY').save()
springSecurityService.clearCachedRequestmaps()

package com.yourcompany.yourapp

import grails.plugin.springsecurity.annotation.Secured

class SecureController {

   @Secured("hasRole('ROLE_ADMIN')")
   def someAction() {
      ...
   }

   @Secured("authentication.name == 'ralph'")
   def someOtherAction() {
      ...
   }
}

new Requestmap(url: "/secure/someAction",
               configAttribute: "hasRole('ROLE_ADMIN')").save()

new Requestmap(url: "/secure/someOtherAction",
               configAttribute: "authentication.name == 'ralph'").save()

grails.plugin.springsecurity.controllerAnnotations.staticRules = [
   [pattern: '/secure/someAction',      access: ["hasRole('ROLE_ADMIN')"]],
   [pattern: '/secure/someOtherAction', access: ["authentication.name == 'ralph'"]]
]

def springSecurityService

package com.foo.bar

import org.springframework.context.ApplicationListener
import org.springframework.security.authentication.event.AuthenticationSuccessEvent

class MySecurityEventListener
      implements ApplicationListener<AuthenticationSuccessEvent> {

   void onApplicationEvent(AuthenticationSuccessEvent event) {
      // handle the event
   }
}

import com.foo.bar.MySecurityEventListener

beans = {
   mySecurityEventListener(MySecurityEventListener)
}

grails.plugin.springsecurity.useSecurityEventListener = true

grails.plugin.springsecurity.onInteractiveAuthenticationSuccessEvent = { e, appCtx ->
   // handle InteractiveAuthenticationSuccessEvent
}

grails.plugin.springsecurity.onAbstractAuthenticationFailureEvent = { e, appCtx ->
   // handle AbstractAuthenticationFailureEvent
}

grails.plugin.springsecurity.onAuthenticationSuccessEvent = { e, appCtx ->
   // handle AuthenticationSuccessEvent
}

grails.plugin.springsecurity.onAuthenticationSwitchUserEvent = { e, appCtx ->
   // handle AuthenticationSwitchUserEvent
}

grails.plugin.springsecurity.onAuthorizationEvent = { e, appCtx ->
   // handle AuthorizationEvent
}

grails.plugin.springsecurity.useBasicAuth = true
grails.plugin.springsecurity.basic.realmName = "Ralph's Bait and Tackle"

grails.plugin.springsecurity.filterChain.chainMap = [
   [pattern: '/webservice/**', filters: 'JOINED_FILTERS,-exceptionTranslationFilter'],
   [pattern: '/**',            filters: 'JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter']
]

grails.plugin.springsecurity.useDigestAuth = true
grails.plugin.springsecurity.digest.realmName = "Ralph's Bait and Tackle"

var onLogin;

$.ajaxSetup({
   beforeSend: function(jqXHR, event) {
      if (event.url != $("#ajaxLoginForm").attr("action")) {
         // save the 'success' function for later use if
         // it wasn't triggered by an explicit login click
         onLogin = event.success;
      }
   },
   statusCode: {
      // Set up a global Ajax error handler to handle 401
      // unauthorized responses. If a 401 status code is
      // returned the user is no longer logged in (e.g. when
      // the session times out), so re-display the login form.
      401: function() {
         showLogin();
      }
   }
});

function showLogin() {
   var ajaxLogin = $("#ajaxLogin");
   ajaxLogin.css("text-align", "center");
   ajaxLogin.jqmShow();
}

function logout(event) {
   event.preventDefault();
   $.ajax({
      url: $("#_logout").attr("href"),
      method: "POST",
      success: function(data, textStatus, jqXHR) {
         window.location = "/";
      },
      error: function(jqXHR, textStatus, errorThrown) {
         console.log("Logout error, textStatus: " + textStatus +
                     ", errorThrown: " + errorThrown);
      }
   });
}

function authAjax() {
   $("#loginMessage").html("Sending request ...").show();

   var form = $("#ajaxLoginForm");
   $.ajax({
      url:       form.attr("action"),
      method:   "POST",
      data:      form.serialize(),
      dataType: "JSON",
      success: function(json, textStatus, jqXHR) {
         if (json.success) {
            form[0].reset();
            $("#loginMessage").empty();
            $("#ajaxLogin").jqmHide();
            $("#loginLink").html(
               'Logged in as ' + json.username +
               ' (<a href="' + $("#_logout").attr("href") +
               '" id="logout">Logout</a>)');
            $("#logout").click(logout);
            if (onLogin) {
               // execute the saved event.success function
               onLogin(json, textStatus, jqXHR);
            }
         }
         else if (json.error) {
            $("#loginMessage").html('<span class="errorMessage">' +
                                    json.error + "</error>");
         }
         else {
            $("#loginMessage").html(jqXHR.responseText);
         }
      },
      error: function(jqXHR, textStatus, errorThrown) {
         if (jqXHR.status == 401 && jqXHR.getResponseHeader("Location")) {
            // the login request itself wasn't allowed, possibly because the
            // post url is incorrect and access was denied to it
            $("#loginMessage").html('<span class="errorMessage">' +
               'Sorry, there was a problem with the login request</error>');
         }
         else {
            var responseText = jqXHR.responseText;
            if (responseText) {
               var json = $.parseJSON(responseText);
               if (json.error) {
                  $("#loginMessage").html('<span class="errorMessage">' +
                                          json.error + "</error>");
                  return;
               }
            }
            else {
               responseText = "Sorry, an error occurred (status: " +
                              textStatus + ", error: " + errorThrown + ")";
            }
            $("#loginMessage").html('<span class="errorMessage">' +
                                    responseText + "</error>");
         }
      }
   });
}

$(function() {
   $("#ajaxLogin").jqm({ closeOnEsc: true });
   $("#ajaxLogin").jqmAddClose("#cancelLogin");
   $("#ajaxLoginForm").submit(function(event) {
      event.preventDefault();
      authAjax();
   });
   $("#authAjax").click(authAjax);
   $("#logout").click(logout);
});

#ajaxLogin {
   padding:    0px;
   text-align: center;
   display:    none;
}

#ajaxLogin .inner {
   width:              400px;
   padding-bottom:     6px;
   margin:             60px auto;
   text-align:         left;
   border:             1px solid #aab;
   background-color:   #f0f0fa;
   -moz-box-shadow:    2px 2px 2px #eee;
   -webkit-box-shadow: 2px 2px 2px #eee;
   -khtml-box-shadow:  2px 2px 2px #eee;
   box-shadow:         2px 2px 2px #eee;
}

#ajaxLogin .inner .fheader {
   padding:          18px 26px 14px 26px;
   background-color: #f7f7ff;
   margin:           0px 0 14px 0;
   color:            #2e3741;
   font-size:        18px;
   font-weight:      bold;
}

#ajaxLogin .inner .cssform p {
   clear:         left;
   margin:        0;
   padding:       4px 0 3px 0;
   padding-left:  105px;
   margin-bottom: 20px;
   height:        1%;
}

#ajaxLogin .inner .cssform input[type="text"],
#ajaxLogin .inner .cssform input[type="password"] {
   width: 150px;
}

#ajaxLogin .inner .cssform label {
   font-weight:   bold;
   float:         left;
   text-align:    right;
   margin-left:  -105px;
   width:         150px;
   padding-top:   3px;
   padding-right: 10px;
}

.ajaxLoginButton {
   background-color: #efefef;
   font-weight: bold;
   padding: 0.5em 1em;
   display: -moz-inline-stack;
   display: inline-block;
   vertical-align: middle;
   white-space: nowrap;
   overflow: visible;
   text-decoration: none;
      -moz-border-radius: 0.3em;
   -webkit-border-radius: 0.3em;
           border-radius: 0.3em;
}

.ajaxLoginButton:hover, .ajaxLoginButton:focus {
   background-color: #999999;
   color: #ffffff;
}

#ajaxLogin .inner .login_message {
   padding: 6px 25px 20px 25px;
   color:   #c33;
}

#ajaxLogin .inner .text_ {
   width: 120px;
}

#ajaxLogin .inner .chk {
   height: 12px;
}

.errorMessage {
   color: red;
}

//= require_tree .

/*
 ...
 *= require ajaxLogin
 *= require jqModal
 ...
 */

<span id="logoutLink" style="display: none;">
<g:link elementId='_logout' controller='logout'>Logout</g:link>
</span>

<span id="loginLink" style="position: relative; margin-right: 30px; float: right">
<sec:ifLoggedIn>
   Logged in as <sec:username/> (<g:link elementId='logout' controller='logout'>Logout</g:link>)
</sec:ifLoggedIn>
<sec:ifNotLoggedIn>
   <a href="#" onclick="showLogin(); return false;">Login</a>
</sec:ifNotLoggedIn>
</span>

<div id="ajaxLogin" class="jqmWindow" style="z-index: 3000;">
   <div class="inner">
      <div class="fheader">Please Login..</div>
      <form action="${request.contextPath}/login/authenticate" method="POST"
            id="ajaxLoginForm" name="ajaxLoginForm" class="cssform" autocomplete="off">
         <p>
            <label for="username">Username:</label>
            <input type="text" class="text_" name="username" id="username" />
         </p>
         <p>
            <label for="password">Password</label>
            <input type="password" class="text_" name="password" id="password" />
         </p>
         <p>
            <label for="remember_me">Remember me</label>
            <input type="checkbox" class="chk" id="remember_me" name="remember-me"/>
         </p>
         <p>
            <input type="submit" id="authAjax" name="authAjax"
                   value="Login" class="ajaxLoginButton" />
            <input type="button" id="cancelLogin" value="Cancel"
                   class="ajaxLoginButton" />
         </p>
      </form>
      <div style="display: none; text-align: left;" id="loginMessage"></div>
   </div>
</div>

<html lang="en" class="no-js">
   <head>
      ...
      <g:layoutHead/>
   </head>
   <body>
      <g:render template='/includes/ajaxLogin'/>
      ...
      <g:layoutBody/>
   </body>
</html>

class MyController {

   def springSecurityService

   def someAction() {
      def user = ...
      // update user data
      user.save()
      springSecurityService.reauthenticate user.username
      ...
   }
}

grails.plugin.springsecurity.password.algorithm = 'bcrypt'

grails.plugin.springsecurity.password.bcrypt.logrounds = 15

import org.springframework.security.authentication.LockedException
import org.springframework.security.authentication.DisabledException
import org.springframework.security.authentication.AccountExpiredException
import org.springframework.security.authentication.CredentialsExpiredException

grails.plugin.springsecurity.failureHandler.exceptionMappings = [
   [exception: LockedException.name,             url: '/user/accountLocked'],
   [exception: DisabledException.name,           url: '/user/accountDisabled'],
   [exception: AccountExpiredException.name,     url: '/user/accountExpired'],
   [exception: CredentialsExpiredException.name, url: '/user/passwordExpired']
]

grails.plugin.springsecurity.errors.login.locked = "None shall pass."

def passwordExpired() {
   [username: session['SPRING_SECURITY_LAST_USERNAME']]
}

<div id='login'>
   <div class='inner'>
      <g:if test='${flash.message}'>
      <div class='login_message'>${flash.message}</div>
      </g:if>
      <div class='fheader'>Please update your password..</div>
      <g:form action='updatePassword' id='passwordResetForm' class='cssform' autocomplete='off'>
         <p>
            <label for='username'>Username</label>
            <span class='text_'>${username}</span>
         </p>
         <p>
            <label for='password'>Current Password</label>
            <g:passwordField name='password' class='text_' />
         </p>
         <p>
            <label for='password'>New Password</label>
            <g:passwordField name='password_new' class='text_' />
         </p>
         <p>
            <label for='password'>New Password (again)</label>
            <g:passwordField name='password_new_2' class='text_' />
         </p>
         <p>
            <input type='submit' value='Reset' />
         </p>
      </g:form>
   </div>
</div>

def updatePassword(String password, String password_new, String password_new_2) {
   String username = session['SPRING_SECURITY_LAST_USERNAME']
   if (!username) {
      flash.message = 'Sorry, an error has occurred'
      redirect controller: 'login', action: 'auth'
      return
   }

   if (!password || !password_new || !password_new_2 || password_new != password_new_2) {
      flash.message = 'Please enter your current password and a valid new password'
      render view: 'passwordExpired', model: [username: session['SPRING_SECURITY_LAST_USERNAME']]
      return
   }

   User user = User.findByUsername(username)
   if (!passwordEncoder.matches(password, user.password)) {
      flash.message = 'Current password is incorrect'
      render view: 'passwordExpired', model: [username: session['SPRING_SECURITY_LAST_USERNAME']]
      return
   }

   if (passwordEncoder.matches(password_new, user.password)) {
      flash.message = 'Please choose a different password from your current one'
      render view: 'passwordExpired', model: [username: session['SPRING_SECURITY_LAST_USERNAME']]
      return
   }

   user.password = password_new
   user.passwordExpired = false
   user.save() // if you have password constraints check them here

   redirect controller: 'login', action: 'auth'
}

./grailsw s2-create-role-hierarchy-entry com.yourapp.RoleHierarchyEntry

package com.yourapp

import groovy.transform.EqualsAndHashCode
import groovy.transform.ToString

@EqualsAndHashCode(includes='entry')
@ToString(includes='entry', includeNames=true, includePackage=false)
class RoleHierarchyEntry implements Serializable {

   private static final long serialVersionUID = 1

   String entry

   static constraints = {
      entry blank: false, unique: true
   }

   static mapping = {
      cache true
   }
}

if (!RoleHierarchyEntry.count()) {
   new RoleHierarchyEntry(entry: 'ROLE_SUPERADMIN > ROLE_FINANCE_ADMIN').save()
   new RoleHierarchyEntry(entry: 'ROLE_FINANCE_ADMIN > ROLE_ADMIN').save()
}

<sec:ifAllGranted roles='ROLE_SWITCH_USER'>

   <form action='/login/impersonate' method='POST'>
      Switch to user: <input type='text' name='username'/> <br/>
      <input type='submit' value='Switch'/>
   </form>

</sec:ifAllGranted>

grails.plugin.springsecurity.controllerAnnotations.staticRules = [
   ...
   [pattern: '/login/impersonate', access: ['ROLE_SWITCH_USER', 'IS_AUTHENTICATED_FULLY']]
]

new Requestmap(url: '/login/impersonate',
               configAttribute: 'ROLE_SWITCH_USER,IS_AUTHENTICATED_FULLY').save(flush: true)

grails.plugin.springsecurity.interceptUrlMap = [
   ...
   [pattern: '/login/impersonate', access: ['ROLE_SWITCH_USER', 'IS_AUTHENTICATED_FULLY']]
]

<sec:ifSwitched>
    <form action='${request.contextPath}/logout/impersonate' method='POST'>
        <input type='submit' value="Resume as ${grails.plugin.springsecurity.SpringSecurityUtils.switchedUserOriginalUsername}"/>
    </form>
</sec:ifSwitched>

grails.plugin.springsecurity.switchUser.switchUserUrl = ...
grails.plugin.springsecurity.switchUser.exitUserUrl = ...
grails.plugin.springsecurity.switchUser.targetUrl = ...
grails.plugin.springsecurity.switchUser.switchFailureUrl = ...

<sec:ifLoggedIn>
Logged in as <sec:username/>
</sec:ifLoggedIn>

<sec:ifSwitched>
    <form action='${request.contextPath}/logout/impersonate' method='POST'>
      <input type='submit' value="Resume as ${grails.plugin.springsecurity.SpringSecurityUtils.switchedUserOriginalUsername}"/>
   </form>
</sec:ifSwitched>

<sec:ifNotSwitched>
   <sec:ifAllGranted roles='ROLE_SWITCH_USER'>

   <form action='${request.contextPath}/login/impersonate' method='POST'>
      Switch to user: <input type='text' name='username'/><br/>
      <input type='submit' value='Switch'/>
   </form>

   </sec:ifAllGranted>
</sec:ifNotSwitched>

grails.plugin.springsecurity.filterChain.filterNames = [
   'securityContextPersistenceFilter', 'logoutFilter',
   'authenticationProcessingFilter', 'myCustomProcessingFilter',
   'rememberMeAuthenticationFilter', 'anonymousAuthenticationFilter',
   'exceptionTranslationFilter', 'filterInvocationInterceptor'
]

grails.plugin.springsecurity.filterChain.chainMap = [
   [pattern: '/urlpattern1/**', filters: 'filter1,filter2,filter3,filter4'],
   [pattern: '/urlpattern2/**', filters: 'filter1,filter3,filter5'],
   [pattern: '/**',             filters: 'JOINED_FILTERS']
]

grails.plugin.springsecurity.filterChain.chainMap = [
   [pattern: '/webservice/**', filters: 'JOINED_FILTERS,-exceptionTranslationFilter'],
   [pattern: '/**',            filters: 'JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter']
]

grails.plugin.springsecurity.filterChain.chainMap = [
   [pattern: '/someurlpattern/**', filters: 'none'],
   [pattern: '/**',                filters: 'JOINED_FILTERS']
]

import com.mycompany.myapp.MyFilter
import org.springframework.boot.context.embedded.FilterRegistrationBean

beans = {
   myFilter(MyFilter) {
      // properties
   }

   myFilterDeregistrationBean(FilterRegistrationBean) {
      filter = ref('myFilter')
      enabled = false
   }
}

import grails.plugin.springsecurity.SecurityFilterPosition
import grails.plugin.springsecurity.SpringSecurityUtils

class BootStrap {

   def init = {
      SpringSecurityUtils.clientRegisterFilter(
          'myFilter', SecurityFilterPosition.OPENID_FILTER.order + 10)
   }
}

grails.plugin.springsecurity.secureChannel.useHeaderCheckChannelSecurity = true

grails.plugin.springsecurity.secureChannel.secureHeaderName = '...'
grails.plugin.springsecurity.secureChannel.secureHeaderValue = '...'
grails.plugin.springsecurity.secureChannel.insecureHeaderName = '...'
grails.plugin.springsecurity.secureChannel.insecureHeaderValue = '...'

class MyController {

   def someAction() {
      if (isLoggedIn()) {
         ...
      }

      ...

      if (!isLoggedIn()) {
         ...
      }

      // or

      if (loggedIn) {
         ...
      }

      if (!loggedIn) {
         ...
      }
   }
}

class MyController {

   def someAction() {
      if (isLoggedIn()) {
         String username = getPrincipal().username
         ...
      }

      // or

      if (isLoggedIn()) {
         String username = principal.username
         ...
      }
   }
}

class MyController {

   def someAction() {
      if (isLoggedIn()) {
         String email = getAuthenticatedUser().email
         ...
      }

      // or

      if (isLoggedIn()) {
         String email = authenticatedUser.email
         ...
      }
   }
}

./grailsw s2-quickstart DOMAIN_CLASS_PACKAGE USER_CLASS_NAME ROLE_CLASS_NAME [REQUESTMAP_CLASS_NAME] [--groupClassName=GROUP_CLASS_NAME]

./grailsw s2-quickstart com.yourapp User Role

./grailsw s2-quickstart com.yourapp User Role --groupClassName=RoleGroup

./grailsw s2-quickstart com.yourapp Person Authority Requestmap

./grailsw s2-quickstart --uiOnly

./grailsw s2-create-persistent-token <classname>

./grailsw s2-create-persistent-token com.yourapp.PersistentLogin

./grailsw s2-create-role-hierarchy-entry <classname>

./grailsw s2-create-role-hierarchy-entry com.yourapp.RoleHierarchyEntry

maven { url "https://repo.grails.org/grails/core" }

import org.springframework.security.access.prepost.PostFilter
import org.springframework.security.access.prepost.PreAuthorize
import org.springframework.security.core.parameters.P
import grails.gorm.transactions.Transactional

import com.yourapp.Report

class ReportService {

   @PreAuthorize("hasPermission(#id, 'com.yourapp.Report', read) or " +
                 "hasPermission(#id, 'com.yourapp.Report', admin)")
   Report getReport(@P("id") long id) {
      Report.get(id)
   }

   @Transactional
   @PreAuthorize("hasRole('ROLE_USER')")
   Report createReport(params) {
      Report report = new Report(params)
      report.save()
      report
   }

   @PreAuthorize("hasRole('ROLE_USER')")
   @PostFilter("hasPermission(filterObject, read) or " +
               "hasPermission(filterObject, admin)")
   List getAllReports(params = [:]) {
      Report.list(params)
   }

   @Secured(['ROLE_USER', 'ROLE_ADMIN'])
   String getReportName(long id) {
      Report.get(id).name
   }

   @Transactional
   @PreAuthorize("hasPermission(#report, write) or " +
                 "hasPermission(#report, admin)")
   Report updateReport(@P("report") Report report, params) {
      report.properties = params
      report.save()
      report
   }

   @Transactional
   @PreAuthorize("hasPermission(#report, delete) or " +
                 "hasPermission(#report, admin)")
   void deleteReport(@P("report") Report report) {
      report.delete()
   }
}

grails.plugin.springsecurity.acl.authority.
        modifyAuditingDetails = 'ROLE_ACL_MODIFY_AUDITING'

grails.plugin.springsecurity.acl.authority.
        changeOwnership = 'ROLE_ACL_CHANGE_OWNERSHIP'

grails.plugin.springsecurity.acl.authority.
        changeAclDetails = 'ROLE_ACL_CHANGE_DETAILS'

class SecureService {

   @Secured(['ROLE_ADMIN', 'RUN_AS_SUPERUSER'])
   def someMethod() {
      ...
   }
}

package com.mycompany.myapp;

import org.springframework.security.acls.domain.BasePermission;
import org.springframework.security.acls.model.Permission;

public class MyPermission extends BasePermission {

   public static final Permission APPROVE = new MyPermission(1 << 5, 'V');

   protected MyPermission(int mask) {
      super(mask);
   }

   protected MyPermission(int mask, char code) {
      super(mask, code);
   }
}

import com.mycompany.myapp.MyPermissions
...
grails.plugin.springsecurity.acl. permissionClass = MyPermissions

grails.plugin.springsecurity.acl.permissionClass = 'com.mycompany.myapp.MyPermissions'

import org.springframework.security.acls.domain.DefaultPermissionFactory
import com.mycompany.myapp.MyPermission

beans = {
   aclPermissionFactory(DefaultPermissionFactory, MyPermission)
}

@PreAuthorize("hasPermission(#id, 'com.testacl.Report', 'approve')")
Report get(@P("id") long id) {
   Report.get id
}

<div class="buttons">
    <g:form action='edit'>
        <g:hiddenField name="id" value="${reportInstance?.id}" />
        <span class="button">
            <g:submitButton class="edit" name="Edit" />
        </span>
    </g:form>
    <g:form action='delete'>
        <g:hiddenField name="id" value="${reportInstance?.id}" />
        <span class="button">
            <g:submitButton class="delete" name="Delete"
                            onclick="return confirm('Are you sure?');" />
        </span>
    </g:form>
</div>

<g:form action='update'>

<div class="buttons">
    <span class="button"><g:submitButton class="save" name="Update" /></span>
</div>

<g:form action='delete'>
    <g:hiddenField name="id" value="${reportInstance?.id}" />
    <div class="buttons">
        <span class="button">
            <g:submitButton class="delete" name="Delete"
                            onclick="return confirm('Are you sure?');" />
        </span>
    </div>
</g:form>

<sec:ifLoggedIn>

<g:form controller='logout'>
   Logged in as <sec:username/> - <g:submitButton name='logout' value='Logout'/>
</g:form>

</sec:ifLoggedIn>
<sec:ifNotLoggedIn>

<g:link controller='login' action='auth'>Login</g:link>

</sec:ifNotLoggedIn>

aclUtilService.addPermission Report, 1124, 'user123', BasePermission.WRITE

aclUtilService.addPermission reportInstance, 'user123', BasePermission.WRITE

void addPermission(Class<?> domainClass, long id, recipient, Permission permission)

void addPermission(domainObject, recipient, Permission permission)

void addPermission(ObjectIdentity oid, recipient, Permission permission)

aclUtilService.changeOwner reportInstance, 'user123'

void changeOwner(domainObject, String newUsername)

aclUtilService.deleteAcl reportInstance

void deleteAcl(domainObject)

aclUtilService.deletePermission Report, 42, 'user123', BasePermission.WRITE

aclUtilService.deletePermission reportInstance, 'user123', BasePermission.WRITE

void deletePermission(domainObject, recipient, Permission permission)

void deletePermission(Class<?> domainClass, long id, recipient, Permission permission)

if (aclUtilService.hasPermission(auth, reportInstance, BasePermission.WRITE)) {
   ...
}

boolean hasPermission(Authentication authentication, domainObject, Permission... permissions)

boolean hasPermission(Authentication authentication, domainObject, List<Permission> permissions)

def acl = aclUtilService.readAcl(reportInstance)

def acl = aclUtilService.readAcl(Report, 42)

Acl readAcl(domainObject)

Acl readAcl(Class<?> domainClass, id)

<sec:permitted className='com.foo.Report' id='${reportId}' permission='read'>

the body content

</sec:permitted>

<sec:permitted className='com.foo.Report' id='${reportId}' permission='write,read'>

the body content

</sec:permitted>

<%@ page import="org.springframework.security.acls.domain.BasePermission" %>

<sec:permitted className='com.foo.Report' id='${reportId}' permission='${BasePermission.READ}'>

the body content

</sec:permitted>

<%@ page import="org.springframework.security.acls.domain.BasePermission" %>

<sec:permitted className='com.foo.Report' id='${reportId}' permission='${[BasePermission.WRITE,BasePermission.READ]}'>

the body content

</sec:permitted>

<sec:permitted className='com.foo.Report' id='${reportId}' permission='${1}'>

the body content

</sec:permitted>

<sec:permitted className='com.foo.Report' id='${reportId}' permission='2,1'>

the body content

</sec:permitted>

<sec:notPermitted className='com.foo.Report' id='${reportId}' permission='read'>

the body content

</sec:notPermitted>

<sec:notPermitted className='com.foo.Report' id='${reportId}' permission='read,write'>

the body content

</sec:notPermitted>

<%@ page import="org.springframework.security.acls.domain.BasePermission" %>

<sec:notPermitted className='com.foo.Report' id='${reportId}' permission='${BasePermission.READ}'>

the body content

</sec:notPermitted>

<%@ page import="org.springframework.security.acls.domain.BasePermission" %>

<sec:notPermitted className='com.foo.Report' id='${reportId}' permission='${[BasePermission.WRITE,BasePermission.READ]}'>

the body content

</sec:notPermitted>

<sec:notPermitted className='com.foo.Report' id='${reportId}' permission='${1}'>

the body content

</sec:notPermitted>

<sec:notPermitted className='com.foo.Report' id='${reportId}' permission='2,1'>

the body content

</sec:notPermitted>

dependencies {
   ...
   implementation 'org.apache.grails:grails-spring-security-cas:7.0.2-SNAPSHOT'
   ...

grails:
    plugin:
        springsecurity:
            cas:
                loginUri: /login
                serviceUrl: http://localhost:8080/login/cas
                serverUrlPrefix: https://your-cas-server/cas
                proxyCallbackUrl: http://localhost:8080/secure/receptor
                proxyReceptorUrl: /secure/receptor

grails:
   plugin:
      springsecurity:
         logout:
            afterLogoutUrl: https://your-cas-server/cas/logout?url=http://localhost:8080/

grails:
   plugin:
      springsecurity:
         cas:
            useSingleSignout: false

grails:
   plugin:
      springsecurity:

         # LDAP config
         providerNames: ['ldapAuthProvider', 'anonymousAuthenticationProvider'] # specify this when you want to skip attempting to load from db and only use LDAP
         ldap:
            context:
               managerDn: '[distinguishedName]'
               managerPassword: '[password]'
               server: 'ldap://[ip]:[port]/'
            search:
               base: '[the base directory to start the search.  usually something like dc=mycompany,dc=com]'
               filter: 'sAMAccountName={0}' # for Active Directory you need this
               searchSubtree: true
               attributesToReturn: ['mail', 'displayName'] # extra attributes you want returned; see below for custom classes that access this data
            auth:
               hideUserNotFoundExceptions: false

            # role-specific LDAP config
            useRememberMe: false
            authorities:
               ignorePartialResultException: true # typically needed for Active Directory
               retrieveGroupRoles: true
               groupSearchBase: '[the base directory to start the search.  usually something like dc=mycompany,dc=com]'
               # If you don't want to support group membership recursion (groups in groups),
               # then use the following setting
               # grails.plugin.springsecurity.ldap.authorities.groupSearchFilter = 'member={0}'
               # If you wish to support groups with group as members (recursive groups), use
               # the following:
               # groupSearchFilter: '(member:1.2.840.113556.1.4.1941:={0})'

/*
 *  Licensed to the Apache Software Foundation (ASF) under one
 *  or more contributor license agreements.  See the NOTICE file
 *  distributed with this work for additional information
 *  regarding copyright ownership.  The ASF licenses this file
 *  to you under the Apache License, Version 2.0 (the
 *  "License"); you may not use this file except in compliance
 *  with the License.  You may obtain a copy of the License at
 *
 *    https://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing,
 *  software distributed under the License is distributed on an
 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *  KIND, either express or implied.  See the License for the
 *  specific language governing permissions and limitations
 *  under the License.
 */

package spring

import com.mycompany.myapp.MyUserDetailsContextMapper

beans = {
    ldapUserDetailsMapper(MyUserDetailsContextMapper) {
        // bean attributes
    }
}

/*
 *  Licensed to the Apache Software Foundation (ASF) under one
 *  or more contributor license agreements.  See the NOTICE file
 *  distributed with this work for additional information
 *  regarding copyright ownership.  The ASF licenses this file
 *  to you under the Apache License, Version 2.0 (the
 *  "License"); you may not use this file except in compliance
 *  with the License.  You may obtain a copy of the License at
 *
 *    https://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing,
 *  software distributed under the License is distributed on an
 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *  KIND, either express or implied.  See the License for the
 *  specific language governing permissions and limitations
 *  under the License.
 */

package com.mycompany.myapp

import groovy.transform.CompileStatic

import org.springframework.ldap.core.DirContextAdapter
import org.springframework.ldap.core.DirContextOperations
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.core.userdetails.UserDetails
import org.springframework.security.ldap.userdetails.UserDetailsContextMapper

@CompileStatic
class MyUserDetailsContextMapper implements UserDetailsContextMapper {

    @Override
    UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<? extends GrantedAuthority> authorities) {
        String email = ctx.attributes.get('mail')?.get() as String
        String phone = ctx.attributes.get('telephoneNumber')?.get() as String

        new MyUserDetails(username,
                '',
                true,
                true,
                true,
                true,
                authorities,
                email,
                phone)
    }

    @Override
    void mapUserToContext(UserDetails user, DirContextAdapter ctx) {
        throw new IllegalStateException("Only retrieving data from AD is currently supported")
    }
}

/*
 *  Licensed to the Apache Software Foundation (ASF) under one
 *  or more contributor license agreements.  See the NOTICE file
 *  distributed with this work for additional information
 *  regarding copyright ownership.  The ASF licenses this file
 *  to you under the Apache License, Version 2.0 (the
 *  "License"); you may not use this file except in compliance
 *  with the License.  You may obtain a copy of the License at
 *
 *    https://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing,
 *  software distributed under the License is distributed on an
 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 *  KIND, either express or implied.  See the License for the
 *  specific language governing permissions and limitations
 *  under the License.
 */

package com.mycompany.myapp

import groovy.transform.CompileStatic
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.core.userdetails.User

@CompileStatic
class MyUserDetails extends User {

    // extra instance variables
    final String email
    final String telephone

    MyUserDetails(String username, String password, boolean enabled, boolean accountNonExpired,
                  boolean credentialsNonExpired, boolean accountNonLocked,
                  Collection<GrantedAuthority> authorities, String email, String telephone) {

        super(username, password, enabled, accountNonExpired, credentialsNonExpired,
                accountNonLocked, authorities)

        this.email = email
        this.telephone = telephone
    }
}