Spring security, hierarchical roles syntax Grails 3 vs Grails 4

[fjloma]

Expected Behavior

The role hierarchy relationship is specified by the ">" operator:

grails.plugin.springsecurity.roleHierarchy = '''
        ROLE_ADMIN>ROLE_USER
'''

This simple hierarchy is working on Grails 3. A user with ROLE_ADMIN rol, also have the ROLE_USER rol.

Actual Behaviour

This hiearchy specification is not working on Grails 4, and it is not giving any warning or error on application bootup.
A user with ROLE_ADMIN only has this role and it is not inheriting the ROLE_USER.

Steps To Reproduce

You can clone

• https://github.com/fjloma/grails4-spring-security-test to test the Grails 4 failing case
• https://github.com/fjloma/grails3-spring-security-test to thest the Grails 3 working case

If you want to generate the Grails 4 code, follow tutorial https://grails.github.io/grails-spring-security-core/4.0.x/index.html#tutorials until step 26.1.8.8

Change the SecureController class to print the user roles.

SecureController.groovy

package com.mycompany.myapp

import grails.plugin.springsecurity.annotation.Secured
import org.springframework.security.core.context.SecurityContextHolder

class SecureController {
   @Secured('ROLE_ADMIN')
   def index() {
      render 'Secure access only '+ SecurityContextHolder.getContext().getAuthentication().getAuthorities()
   }
}

Test fail

Add the following line to application.groovy a simple role hierarchy. Note there is no spaces arround the ">" symbol.

grails.plugin.springsecurity.roleHierarchy = '''
        ROLE_ADMIN>ROLE_USER
'''

Run the application (grails run-app) and go to http://localhost:8080/secure and log with me / password. It shows:

Secure access only [ROLE_ADMIN]

when te expected value should be

Secure access only [ROLE_USER, ROLE_ADMIN]

Test with spaces

Change the hierarchy configuration on application.groovy to have spaces arround the ">"

grails.plugin.springsecurity.roleHierarchy = '''
        ROLE_ADMIN > ROLE_USER
'''

Run the application (grails run-app) and go to http://localhost:8080/secure and log with me / password. Now it shows the correct values:

Secure access only [ROLE_USER, ROLE_ADMIN]

Environment Information

• Operating System: Mac OS Monterrey 12.2.1 Apple M1 Max
• Grails Version: 4.0.13
• JVM Version: 1.8.0_312
• Groovy 2.5.14

Example Application

https://github.com/fjloma/grails4-spring-security-test

Version

4.0.13

[puneetbehl]

Thank you for reporting the issue. We are sorry that you are facing this issue. We will soon investigate that why it is broken and will update you.

[davebrown1975]

Any update yet on this issue? I'm facing something similar but not constantly reproducable.