One of the easiest methods for adding security to your host application is by configuring grails filters to control access to controllers and actions.
Configuring filters is a simple process. In your host application you simply need to invoke the accessControl closure when a controller and action pair is matched.
The following example shows the usage of the accessControl closure in filters.
public class NimbleSecurityFilters extends grails.plugins.nimble.security.NimbleFilterBase {
def filters = {
// Content requiring users to be authenticated
secure(controller: "main") {
before = {
accessControl {
true
}
}
}
profilesecure(controller: "profile") {
before = {
if(!actionName.equals('miniprofile')) {
accessControl {
true
}
}
}
}
// Account management requiring authentication
accountsecure(controller: "account", action: "(changepassword|updatepassword|changedpassword)") {
before = {
accessControl {
true
}
}
}
// This should be extended as the application adds more administrative functionality
administration(controller: "(admins|user|group|role)") {
before = {
accessControl {
role(AdminsService.ADMIN_ROLE)
}
}
}
// Creating, modifying, or deleting a book requires the "Administrator" role.
bookEditing(controller: "book", action: "(create|edit|save|update|delete)") {
before = {
accessControl {
role("Administrator")
}
}
} // Showing a book requires the "Administrator" *or* the "User" roles.
bookShow(controller: "book", action: "show") {
before = {
accessControl {
role("Administrator") || permission("book:show")
}
}
} }
}
|