See the light - agile, industrial strength, rapid web application development made easy

(Quick Reference) # 14.5 Security Plugins - Reference Documentation Authors: Graeme Rocher, Peter Ledbrook, Marc Palmer, Jeff Brown, Luke Daley, Burt Beckwith, Lari Hotari Version: 2.3.8 ## Table of Contents ## 14.5 Security Plugins If you need more advanced functionality beyond simple authentication such as authorization, roles etc. then you should consider using one of the available security plugins. ## 14.5.1 Spring Security The Spring Security plugins are built on the Spring Security project which provides a flexible, extensible framework for building all sorts of authentication and authorization schemes. The plugins are modular so you can install just the functionality that you need for your application. The Spring Security plugins are the official security plugins for Grails and are actively maintained and supported. There is a Core plugin which supports form-based authentication, encrypted/salted passwords, HTTP Basic authentication, etc. and secondary dependent plugins provide alternate functionality such as OpenID authentication, ACL support, single sign-on with Jasig CAS, LDAP authentication, Kerberos authentication, and a plugin providing user interface extensions and security workflows. See the Core plugin page for basic information and the user guide for detailed information. ## 14.5.2 Shiro Shiro is a Java POJO-oriented security framework that provides a default domain model that models realms, users, roles and permissions. With Shiro you extend a controller base class called `JsecAuthBase` in each controller you want secured and then provide an `accessControl` block to setup the roles. An example below:

    class ExampleController extends JsecAuthBase {
        static accessControl = {
            // All actions require the 'Observer' role.
            role(name: 'Observer')        // The 'edit' action requires the 'Administrator' role.
            role(name: 'Administrator', action: 'edit')        // Alternatively, several actions can be specified.
            role(name: 'Administrator', only: [ 'create', 'edit', 'save', 'update' ])
        }
        …
    }
For more information on the Shiro plugin refer to the documentation. | Quick Reference (hide)