Suitable Security Plugins for Grails

Question

Hello All.

I have been working on a project which uses Grails with Hibernate...

Now the project is up and running very well now, but the thing that I need to integrate is the most important part of project i.e. Security.

So, for security I have found out some of the plugins that are available with grails like ACEGI (i think it's Spring Security Now), Stark Security, JSecurity (Apache Ki now).

So amongst all of them I would like to know the features/drawbacks or any other plugins suggestion, if anybody have used/faced.

Any help would be highly appreciated...

Thanks...

Answer 1

highly recommend http://www.grails.org/plugin/spring-security-core.

used it on a project, was extensible, well documented and has a large community of users to help out when you run in to problems.

Answer 2

Good option is spring-security-core or apache-schiro plugin.

I have very good experiences with nimble plugin which can be very easily integrated into existing projects.

Answer 3

I would recommend Spring Security Core. (My second choice would be Shiro)

I have used Stark, Acegi, JSecurity and Spring Security Core on different large Grails applications all successfully.

Stark Security: good for locking everything down by default. Stark is based on Spring Security 2.0.x (formerly known as Acegi Security : not the Grails plugin), Decent Plugin and does some stuff that the Acegi Plugin doesn't do.

Acegi: based on Spring Security 2.0.x (formerly known as Acegi Security : not the Grails plugin), This plugin was replaced by the Spring Security Core plugin

Spring Security Core: Based on Spring Security 3.0, is the successor to the Acegi plugin. Modular in nature, and this would be my highest recommendation!

Shiro: Jsecurity was renamed to Apache Ki and then to Apache Shiro thus the Grails plugins followed (JSecurity, Apache Ki, Apache Shiro) When I used this plugin it was the JSecurity plugin. It had a decent 3 level support (user / role / ACL), but lacked some of the more mature features (saved requests on session timeout for instance..) Shiro may have these features now, but I'm not sure.