Grails 安全注释，@Secured(['ROLE_ADMIN']) 不显示角色内容

Question

我正在尝试为所有用户呈现一些内容，并为 ROLE_ADMIN 呈现一些内容。我可以同时以 adminuser 和 useruser（通过 CAS 身份验证）身份登录，但两者的内容相同

这是控制器

package college.infotech.edu

    import java.awt.GraphicsConfiguration.DefaultBufferCapabilities;
    import grails.plugin.springsecurity.annotation.Secured

    class SecureController {

       @Secured(['ROLE_ADMIN', 'ROLE_USER'])
       def index() {
          render 'All Users see this'

       def showUserName
          render "<br />"   
          render request.remoteUser

          @Secured(['ROLE_ADMIN'])
          def showAdmin = {
             render "<br />"
             render "admin users see this"
          }
      }

这是我的 bootstrap.groovy（它一直在工作并通过 CAS 进行身份验证

 .......

 def init = { servletContext ->

      def adminRole = new Role(authority: 'ROLE_ADMIN').save(flush: true)
      def userRole = new Role(authority: 'ROLE_USER').save(flush: true)

      def testUser = new AppUser(username: 'adminuser', password:'password', enabled: true, accountExpired: false, accountLocked: false, passwordExpired: false)
      testUser.save(flush: true)

      def testUser2 = new AppUser(username: 'useruser', password:'password', enabled: true, accountExpired: false, accountLocked: false, passwordExpired: false)
      testUser2.save(flush: true)

      UserRole.create testUser, adminRole, true
      UserRole.create testUser2, userRole, true

      assert AppUser.count() == 2
      assert Role.count() == 2
      assert UserRole.count() == 2
   }

   .......

这里有一些相关的日志条目

[http-bio-8080-exec-8] DEBUG intercept.FilterSecurityInterceptor  - Secure object: FilterInvocation: URL: /secure/index; Attributes: [ROLE_ADMIN, ROLE_USER]
[http-bio-8080-exec-8] DEBUG intercept.FilterSecurityInterceptor  - Previously Authenticated: org.springframework.security.cas.authentication.CasAuthenticationToken@5d4cb3a4: Principal: grails.plugin.springsecurity.userdetails.GrailsUser@17617e0a: Username: adminuser; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@21a2c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: CCFEACE94A4EC5FFB3B13ACA0E06BB1A; Granted Authorities: ROLE_ADMIN Assertion: org.jasig.cas.client.validation.AssertionImpl@37b7e6ad [http-bio-8080-exec-8] DEBUG hierarchicalroles.RoleHierarchyImpl  - getReachableGrantedAuthorities() - From the roles [ROLE_ADMIN] one can reach [ROLE_ADMIN] in zero or more steps.
[http-bio-8080-exec-8] DEBUG intercept.FilterSecurityInterceptor  - Authorization successful

Answer 1

这是一个看起来很奇怪的控制器动作。这是一个名为index 的方法，由 ROLE_ADMIN 或 ROLE_USER 保护，以及多个渲染调用和一个神秘的注释 showAdmin 闭包。一般来说，您应该只有一个 render 调用，如果 Grails 为您连接多个调用的渲染输出，您应该认为这是一个将在某个时候修复的错误。

内部 showAdmin 闭包没有做任何事情。它只是方法中间的一个闭包，Grails 或您的代码不会调用它。由于它只是方法中的一个对象，因此 Grails 不会将其视为可调用操作，Spring Security 也不会将其视为需要保护或处理的东西。