Question

我正在尝试为所有用户呈现一些内容，而为ROLE_ADMIN呈现一些内容。我可以同时以adminuser和useruser身份登录（通过CAS进行authed），但是看到两者的内容相同

这是控制器

package college.infotech.edu

    import java.awt.GraphicsConfiguration.DefaultBufferCapabilities;
    import grails.plugin.springsecurity.annotation.Secured

    class SecureController {

       @Secured(['ROLE_ADMIN', 'ROLE_USER'])
       def index() {
          render 'All Users see this'

       def showUserName
          render "<br />"   
          render request.remoteUser

          @Secured(['ROLE_ADMIN'])
          def showAdmin = {
             render "<br />"
             render "admin users see this"
          }
      }

这是我的bootstrap.groovy（已经工作并通过CAS进行身份验证

 .......

 def init = { servletContext ->

      def adminRole = new Role(authority: 'ROLE_ADMIN').save(flush: true)
      def userRole = new Role(authority: 'ROLE_USER').save(flush: true)

      def testUser = new AppUser(username: 'adminuser', password:'password', enabled: true, accountExpired: false, accountLocked: false, passwordExpired: false)
      testUser.save(flush: true)

      def testUser2 = new AppUser(username: 'useruser', password:'password', enabled: true, accountExpired: false, accountLocked: false, passwordExpired: false)
      testUser2.save(flush: true)

      UserRole.create testUser, adminRole, true
      UserRole.create testUser2, userRole, true

      assert AppUser.count() == 2
      assert Role.count() == 2
      assert UserRole.count() == 2
   }

   .......

这是一些相关的日志条目

[http-bio-8080-exec-8] DEBUG intercept.FilterSecurityInterceptor  - Secure object: FilterInvocation: URL: /secure/index; Attributes: [ROLE_ADMIN, ROLE_USER]
[http-bio-8080-exec-8] DEBUG intercept.FilterSecurityInterceptor  - Previously Authenticated: org.springframework.security.cas.authentication.CasAuthenticationToken@5d4cb3a4: Principal: grails.plugin.springsecurity.userdetails.GrailsUser@17617e0a: Username: adminuser; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@21a2c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CCFEACE94A4EC5FFB3B13ACA0E06BB1A; Granted Authorities: ROLE_ADMIN Assertion: org.jasig.cas.client.validation.AssertionImpl@37b7e6ad [http-bio-8080-exec-8] DEBUG hierarchicalroles.RoleHierarchyImpl  - getReachableGrantedAuthorities() - From the roles [ROLE_ADMIN] one can reach [ROLE_ADMIN] in zero or more steps.
[http-bio-8080-exec-8] DEBUG intercept.FilterSecurityInterceptor  - Authorization successful

Answer 1

这是一个奇怪的控制器动作。这是一个名为index的方法，使用ROLE_ADMIN或ROLE_USER以及多个渲染调用和一个神秘的带注释的showAdmin闭包来保护。一般来说，你应该只有一个render调用，如果Grails连接多个调用的渲染输出，你应该认为它是一个将在某个时候修复的错误。

内部showAdmin闭包没有做任何事情。它只是一个方法中间的闭包，它不是由Grails或您的代码调用的。由于它只是方法中的一个对象，因此Grails不会将其视为可调用的操作，并且Spring Security并未将其视为需要保护或处理的内容。

Grails安全注释，@ Secure（['ROLE_ADMIN']）不显示角色的内容

1 个答案: