Grails Spring Security RequestMap not matching /

Question

My app has this url mapping:

"/"(controller: 'app', action: 'index')

And I'm using a domain class to store RequestMap instances in the database. The access to app/index is restricted to certain roles, so when a user hits / or /app/index, the login form is shown.

When a user, that has permissions to see / or /app/index logs in, the app is showing a message: "Sorry, you're not authorized to view this page.", so for some reason Spring Security is not considering my RequestMaps.

I tried a lot of combinations, maybe I'm missing something. What I have right now is (Bootstrap.groovy):

 new RequestMap(url: '/', configAttribute: 'ROLE_ADMIN').save()
 new RequestMap(url: '/app/index', configAttribute: 'ROLE_ADMIN').save()
 new RequestMap(url: '/**', configAttribute: 'ROLE_ADMIN').save()

The user I'm using to login has ROLE_ADMIN assigned, this is the console log on login:

userDetails grails.plugin.springsecurity.userdetails.GrailsUser@586034f:
Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true;
credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN
auth com.cabolabs.security.UserPassOrgAuthToken@40a3c9e2:
Principal: grails.plugin.springsecurity.userdetails.GrailsUser@586034f:
Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true;
credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN;
Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: ROLE_ADMIN

FYI, I customized the login to use user+pass+organization, that's why there is a UserPassOrgAuthToken instead of the standard UsernamePasswordAuthenticationToken

Edit

I also have rejectIfNoRule = true and defaultTargetUrl = '/app/index', not sure if this is affecting anything:

grails.plugin.springsecurity.rejectIfNoRule = true
grails.plugin.springsecurity.successHandler.defaultTargetUrl = '/app/index' // "/" is mapped to "/app/index"

Pablo Pazos Pablo Pazos · Accepted Answer · 2015-10-09T03:41:44

It seems I can't secure "/", googling for days and there are no examples of securing "/".

What I did was:

change the mappging from "/" to "/app/index" for "/" to "/login"
keep the just new RequestMap(url: '/app/index', configAttribute: 'ROLE_ADMIN').save()

So, accessing to the app without being logged in, redirects me to "/login". If I access to "/" being logged in, it redirects to "/app/index" (defaultTargetUrl).

This is the expected behavior but I had to remove my requirement of showing a dashboard when the user access to my web root "/", now my users see "/app/index" instead of "/" in the URL.

Grails Spring Security RequestMap not matching /

1 Answers