3

I spent a couple of weeks trying to figure out what solution I should bring to this question I posted. Since I couldn't find a full documentation for Shiro-Grails integration, I am looking for some other framework (like Spring) to secure our lightweight web based Grails application.

The application is couple of months old and it is not a huge application. Not more 20 persistent classes. However, I believe it will grow up soon. But, security is not implemented yet and I want to make sure that I will find the best security framework (for me the best might include: free source, well documented, easy to integrate with Grails, extensible, and last but not least more secured).

Any suggestions?

Community
  • 1
  • 1
WowBow
  • 7,137
  • 17
  • 65
  • 103

3 Answers3

8

Steve is right - it is between SpringSecurity and Shiro.

I am using Shiro - the documentation isn't as good as it could be, but the *-Permissions are great.

You grant permission by specifying "controller:action" tuples. And you can use lists and wildcards:

"*:list,show" //everything read-only
"book:*"      //everything allowed on the book class
"*:*"         //admin

As a result, you have all permissions as whitelist (based on controller:action) in one file.

What I've seens so far for SpringSecurity is that you often base the permissions on URLs - that's IMHO an easy way to miss to secure a controller or action. see Securing actions in Grails 2 rc3 for example :-)

PS: if anybody knows how this kind of *-Permission is done in SpringSecurity, please post a comment!

Community
  • 1
  • 1
rdmueller
  • 10,742
  • 10
  • 69
  • 126
  • 4
    Agreed - the two killer features in Shiro are permissions and distributed sessions. Simplicity is also a selling point. – sourcedelica Jan 05 '12 at 14:53
  • 1
    Thanks Ralf for your comment. Well, I agree with what you guys said. However, the problem I am facing is, I believe, just a simple problem but, because of lack of documentation, I wasted my time for nothing. In case if you haven't looked, here is my previous question http://stackoverflow.com/questions/8584671/access-control-role-and-permission-in-grails . Do you have any clue why its giving all the grants? – WowBow Jan 05 '12 at 17:35
5

The standard Grails security framework is Spring Security. Check out the docs

doelleri
  • 19,232
  • 5
  • 61
  • 65
3

Pretty much it is between SpringSecurity and Shiro.

Spring Security seems to be becoming the standard for Grails as doelleri said, it should provide anything you could ever wish for and is well documented and designed. Shiro I found to be functionally on a par for the basic security tasks but I feel the docs let it down in comparison. There is a plugin (now not being maintained) called Nimble that uses Shiro as a basis, Nimble is powerful and provides a lot of functions such as user management GUI out-of-the-box.

I just started with Spring Security for a new project and am now finding it very powerful and simple to use, and am glad I made the change. But in the end it is up to your project/organisational needs.

Steve
  • 1,457
  • 12
  • 25
  • I still do have the chance to choose Spring over Shiro. Our application is just a simple data management system. It is not a huge system for now. – WowBow Jan 05 '12 at 17:37
  • 1
    MatX a helpful discussion on this just came up in [Grails user](http://grails.1312388.n4.nabble.com/Security-plugins-td4275329.html) – Steve Jan 16 '12 at 02:53