views:

76

answers:

1

Hi,

Im trying to write a Filter for my web-app. I read [the documentation][1], and wrote this dummy filter in my grails-app/conf directory

class SecurityFilters {
   def filters = {
       someFilter(controller:'*',action:'*') {

              write('Filtering')

       }
   }
}

Next thing I do is set a breakpoint on the write statement, but it just doesn't stop there.

Do I need to "register" this filter or anything? Spring may be bodering?

From this question, it doesn't look like it.

Maybe i'm doing something wrong, or overlooked anything?

update

class SecurityFilters {
   def filters = {

       all(controller:'*',action:'*') {
        before={
              println 'Filtering'
              return false
        }
       }
   }
}

Thanks in advance.

[1]: http://www.grails.org/doc/1.3.x/guide/single.html#6.6 Filters

+1  A: 

Two problems. One is there's no 'write' method - change it to 'println' and it should work. But a filter is comprised of some combination of before, after, and afterView sub-closures, so what you really want is

class SecurityFilters {
   def filters = {
      someFilter(controller:'*',action:'*') {
         before = {
            println 'Filtering'
         }
      }
   }
}

But if you're really creating a security filter, please don't. It's too easy to do this incorrectly. The Spring Security Core and Shiro plugins have plenty of features and are easy to configure and use.

Burt Beckwith
Still nothing :( . On ss -core and shiro, i don't think they can do what I need, its highly dependant on data and my database structure. Something on the lines of "if this user belongs to this organization, then grant access"
Tom
i agree with Burt, you should use one of the existing plugins, they can be customize to utilize your own data structures
Aaron Saunders
@Aaron All I see is ROLES and USERS, but nothing else :(
Tom
Ok, I got it working. Turns out that the class name was SecurityFilters, but the file name was SecurityFilter. Refactored the file and voila!. Thank you.
Tom
@Tom you can customize what user details are evaluated during the authentication process take a look at this http://www.grails.org/AcegiSecurity+Plugin+-+Custom+UserDetailsService
Aaron Saunders
You wouldn't want to use the Acegi plugin, it's basically deprecated since all work is being done on the Spring Security Core plugin and its extension plugins. See section 11 in http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/ for the custom UserDetailsService writeup. You can also easily create a custom AuthenticationProvider that provides a more low-level hook into the authentication process.
Burt Beckwith