Archive for December 21st, 2009

Hierarchical Roles in the Grails Spring Security Plugin

Monday, December 21st, 2009

Update: This is a feature in the Spring Security Core plugin – see section “14 Hierarchical Roles” in the docs.

I was looking at a non-Grails Spring Security application that used hierarchical roles and wondered what it’d take to get this working with the Grails plugin. Turns out it’s pretty simple.

Non-hierarchical roles are checked by a RoleVoter but to use hierarchical roles you need a RoleHierarchyVoter. Replacing the roleVoter bean in resources.groovy is all it takes.

RoleHierarchyVoter needs an implementation of RoleHierarchy and the default implementation in Spring Security is RoleHierarchyImpl which parses a String defining the hierarchy. For example, this configuration defines the hierarchy ROLE_SUPERADMIN > ROLE_ADMIN > ROLE_USER:


beans = {

   roleHierarchy(RoleHierarchyImpl) {
      hierarchy = '''

   roleVoter(RoleHierarchyVoter, ref('roleHierarchy'))

You can download a small demo app here that shows how it works. Unpack the app and run grails run-app, and then open http://localhost:8080/hierarchical/secure/. The app creates three users in BootStrap:

Username Password Role
user user ROLE_USER
admin admin ROLE_ADMIN
superadmin superadmin ROLE_SUPERADMIN

so you can login as each user to test the secured actions:

class SecureController {

   def index = {}

   def user = {

   def admin = {

   def superadmin = {

Logout in between by navigating to http://localhost:8080/hierarchical/logout. Although only one role is defined for each action, as the super admin you can access all three, as the admin you can access admin and user, and as the user you can only access user.

I’ll make this part of the plugin at some point to make configuration simpler, but for now it’s not much work to do it explicitly.

Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 License.