views:

26

answers:

1

My grails app is using Spring Security (Acegi). Users can login on /login. after this is successful it redirects to /. if someone now tries get back to the URL /login the browser says "endless redirect, the request could never be ended". in the login controller, action login which shows the login view there is some code

if (isLoggedIn()) {
  redirect uri: '/'
  return
}

but this (and the whole action) is not executed when one hit /login and is loggedin.

SecurityConfig declares

/login/**=ROLE_ANONYMOUS

Any tipps how I stopp the redirect?

A: 

You don't want ROLE_ANONYMOUS since authenticated users won't have it, it's just a fake role that nonauthenticated users get. Use IS_AUTHENTICATED_ANONYMOUSLY instead. This means nonauthenticated, authenticated via remember-me cookie, or authenticated via login form (i.e. all users).

Burt Beckwith
Thanks a lot!!! That works fine. I thought that roles are hierarchily organized? ROLE_ANONYMOUS < ROLE_USER
skurt
There's support for hierarchical roles but you have to define the hierarchy - see section 10.12 in [the docs](http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/)
Burt Beckwith