{"id":1181,"date":"2012-06-01T01:00:00","date_gmt":"2012-06-01T01:00:00","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/2012\/10\/make-your-spring-security-secured-annotations-more-dry.html"},"modified":"2019-02-14T13:31:00","modified_gmt":"2019-02-14T11:31:00","slug":"make-your-spring-security-secured","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html","title":{"rendered":"Make your Spring Security @Secured annotations more DRY"},"content":{"rendered":"
\n

Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations<\/a>. The rules for specifying attributes in Java annotations are pretty restrictive, so I couldn\u2019t see a direct way to do what he was asking.<\/p>\n

Using Groovy doesn\u2019t really help here since for the most part annotations in a Groovy class are pretty much the same as in Java (except for the syntax for array values). Of course Groovy now supports closures in annotations, but this would require a code change in the plugin. But then I thought about some work Jeff Brown did recently in the cache<\/a>\u00a0plugin.<\/p>\n

Spring\u2019s cache abstraction API includes three annotations; @Cacheable<\/code>, @CacheEvict<\/code>, and @CachePut<\/code>. We were thinking ahead about supporting more configuration options than these annotations allow, but since you can\u2019t subclass annotations we decided to use an AST transformation to find our versions of these annotations (currently with the same attributes as the Spring annotations) and convert them to valid Spring annotations. So I looked at Jeff\u2019s code<\/a>\u00a0and it ended up being the basis for a fix for this problem.<\/p>\n

It\u2019s not possible to use code to externalize the authority lists because you can\u2019t control the compilation order. So I ended up with a solution that isn\u2019t perfect but works \u2013 I look for a properties file in the project root (roles.properties<\/code>). The format is simple \u2013 the keys are names for each authority list and the values are the lists of authority names, comma-delimited. Here\u2019s an example:<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n<\/td>\n
\n
\n
admins=ROLE_ADMIN, ROLE_SUPERADMIN<\/code><\/div>\n
switchUser=ROLE_SWITCH_USER<\/code><\/div>\n
editors=ROLE_EDITOR, ROLE_ADMIN<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

These keys are the values you use for the new @Authorities<\/code> annotation:<\/p>\n

\n
\n\n\n\n
\n
01<\/div>\n
02<\/div>\n
03<\/div>\n
04<\/div>\n
05<\/div>\n
06<\/div>\n
07<\/div>\n
08<\/div>\n
09<\/div>\n
10<\/div>\n
11<\/div>\n
12<\/div>\n
13<\/div>\n
14<\/div>\n
15<\/div>\n
16<\/div>\n
17<\/div>\n
18<\/div>\n
19<\/div>\n
20<\/div>\n
21<\/div>\n
22<\/div>\n
23<\/div>\n
24<\/div>\n
25<\/div>\n
26<\/div>\n
27<\/div>\n
28<\/div>\n<\/td>\n
\n
\n
package<\/code> grails.plugins.springsecurity.annotation;<\/code><\/div>\n
<\/div>\n
import<\/code> java.lang.annotation.Documented;<\/code><\/div>\n
import<\/code> java.lang.annotation.ElementType;<\/code><\/div>\n
import<\/code> java.lang.annotation.Inherited;<\/code><\/div>\n
import<\/code> java.lang.annotation.Retention;<\/code><\/div>\n
import<\/code> java.lang.annotation.RetentionPolicy;<\/code><\/div>\n
import<\/code> java.lang.annotation.Target;<\/code><\/div>\n
<\/div>\n
import<\/code> org.codehaus.groovy.transform.GroovyASTTransformationClass;<\/code><\/div>\n
<\/div>\n
\/**<\/code><\/div>\n
\u00a0<\/code>* @author Burt Beckwith<\/code><\/div>\n
\u00a0<\/code>*\/<\/code><\/div>\n
@Target<\/code>({ElementType.FIELD, ElementType.METHOD, ElementType.TYPE})<\/code><\/div>\n
@Retention<\/code>(RetentionPolicy.RUNTIME)<\/code><\/div>\n
@Inherited<\/code><\/div>\n
@Documented<\/code><\/div>\n
@GroovyASTTransformationClass<\/code>(<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>\"grails.plugins.springsecurity.annotation.AuthoritiesTransformation\"<\/code>)<\/code><\/div>\n
public<\/code> @interface<\/code> Authorities {<\/code><\/div>\n
\u00a0\u00a0\u00a0<\/code>\/**<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>* The property file key; the property value will be a<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>* comma-delimited list of role names.<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>* @return the key<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>*\/<\/code><\/div>\n
\u00a0\u00a0\u00a0<\/code>String value();<\/code><\/div>\n
}<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

For example here\u2019s a controller using the new annotation:<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n<\/td>\n
\n
\n
@Authorities<\/code>(<\/code>'admins'<\/code>)<\/code><\/div>\n
class<\/code> SecureController {<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0<\/code>@Authorities<\/code>(<\/code>'editors'<\/code>)<\/code><\/div>\n
\u00a0\u00a0\u00a0<\/code>def someAction() {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>...<\/code><\/div>\n
\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
}<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

This is the equivalent of this controller (and if you decompile the one with @Authorities<\/code> you\u2019ll see both annotations):<\/p>\n

\n
\n\n\n\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n<\/td>\n
\n
\n
@Secured<\/code>([<\/code>'ROLE_ADMIN'<\/code>, <\/code>'ROLE_SUPERADMIN'<\/code>])<\/code><\/div>\n
class<\/code> SecureController {<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0<\/code>@Secured<\/code>([<\/code>'ROLE_EDITOR'<\/code>, <\/code>'ROLE_ADMIN'<\/code>])<\/code><\/div>\n
\u00a0\u00a0\u00a0<\/code>def someAction() {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>...<\/code><\/div>\n
\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
}<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

The AST transformation class looks for @Authorities<\/code> annotations, loads the properties file, and adds a new @Secured<\/code> annotation (the @Authorities<\/code> annotation isn\u2019t removed) using the role names specified in the properties file:

<\/div> <\/div><\/p>\n
\n
\n\n\n\n
\n
001<\/div>\n
002<\/div>\n
003<\/div>\n
004<\/div>\n
005<\/div>\n
006<\/div>\n
007<\/div>\n
008<\/div>\n
009<\/div>\n
010<\/div>\n
011<\/div>\n
012<\/div>\n
013<\/div>\n
014<\/div>\n
015<\/div>\n
016<\/div>\n
017<\/div>\n
018<\/div>\n
019<\/div>\n
020<\/div>\n
021<\/div>\n
022<\/div>\n
023<\/div>\n
024<\/div>\n
025<\/div>\n
026<\/div>\n
027<\/div>\n
028<\/div>\n
029<\/div>\n
030<\/div>\n
031<\/div>\n
032<\/div>\n
033<\/div>\n
034<\/div>\n
035<\/div>\n
036<\/div>\n
037<\/div>\n
038<\/div>\n
039<\/div>\n
040<\/div>\n
041<\/div>\n
042<\/div>\n
043<\/div>\n
044<\/div>\n
045<\/div>\n
046<\/div>\n
047<\/div>\n
048<\/div>\n
049<\/div>\n
050<\/div>\n
051<\/div>\n
052<\/div>\n
053<\/div>\n
054<\/div>\n
055<\/div>\n
056<\/div>\n
057<\/div>\n
058<\/div>\n
059<\/div>\n
060<\/div>\n
061<\/div>\n
062<\/div>\n
063<\/div>\n
064<\/div>\n
065<\/div>\n
066<\/div>\n
067<\/div>\n
068<\/div>\n
069<\/div>\n
070<\/div>\n
071<\/div>\n
072<\/div>\n
073<\/div>\n
074<\/div>\n
075<\/div>\n
076<\/div>\n
077<\/div>\n
078<\/div>\n
079<\/div>\n
080<\/div>\n
081<\/div>\n
082<\/div>\n
083<\/div>\n
084<\/div>\n
085<\/div>\n
086<\/div>\n
087<\/div>\n
088<\/div>\n
089<\/div>\n
090<\/div>\n
091<\/div>\n
092<\/div>\n
093<\/div>\n
094<\/div>\n
095<\/div>\n
096<\/div>\n
097<\/div>\n
098<\/div>\n
099<\/div>\n
100<\/div>\n
101<\/div>\n
102<\/div>\n
103<\/div>\n
104<\/div>\n
105<\/div>\n
106<\/div>\n
107<\/div>\n
108<\/div>\n
109<\/div>\n
110<\/div>\n
111<\/div>\n
112<\/div>\n
113<\/div>\n
114<\/div>\n
115<\/div>\n
116<\/div>\n
117<\/div>\n
118<\/div>\n
119<\/div>\n
120<\/div>\n
121<\/div>\n
122<\/div>\n<\/td>\n
\n
\n
package<\/code> grails.plugins.springsecurity.annotation;<\/code><\/div>\n
<\/div>\n
import<\/code> grails.plugins.springsecurity.Secured;<\/code><\/div>\n
<\/div>\n
import<\/code> java.io.File;<\/code><\/div>\n
import<\/code> java.io.FileReader;<\/code><\/div>\n
import<\/code> java.io.IOException;<\/code><\/div>\n
import<\/code> java.util.ArrayList;<\/code><\/div>\n
import<\/code> java.util.List;<\/code><\/div>\n
import<\/code> java.util.Properties;<\/code><\/div>\n
<\/div>\n
import<\/code> org.codehaus.groovy.ast.ASTNode;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.ast.AnnotatedNode;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.ast.AnnotationNode;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.ast.ClassNode;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.ast.expr.ConstantExpression;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.ast.expr.Expression;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.ast.expr.ListExpression;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.control.CompilePhase;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.control.SourceUnit;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.transform.ASTTransformation;<\/code><\/div>\n
import<\/code> org.codehaus.groovy.transform.GroovyASTTransformation;<\/code><\/div>\n
import<\/code> org.springframework.util.StringUtils;<\/code><\/div>\n
<\/div>\n
\/**<\/code><\/div>\n
\u00a0<\/code>* @author Burt Beckwith<\/code><\/div>\n
\u00a0<\/code>*\/<\/code><\/div>\n
@GroovyASTTransformation<\/code>(phase=CompilePhase.CANONICALIZATION)<\/code><\/div>\n
public<\/code> class<\/code> AuthoritiesTransformation <\/code>implements<\/code> ASTTransformation {<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0<\/code>protected<\/code> static<\/code> final<\/code> ClassNode SECURED =<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>new<\/code> ClassNode(Secured.<\/code>class<\/code>);<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0<\/code>public<\/code> void<\/code> visit(ASTNode[] astNodes, SourceUnit sourceUnit) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>try<\/code> {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>ASTNode firstNode = astNodes[<\/code>0<\/code>];<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>ASTNode secondNode = astNodes[<\/code>1<\/code>];<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (!(firstNode <\/code>instanceof<\/code> AnnotationNode) ||<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>!(secondNode <\/code>instanceof<\/code> AnnotatedNode)) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>throw<\/code> new<\/code> RuntimeException(<\/code>\"Internal error: wrong types: \"<\/code> +<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>firstNode.getClass().getName() +<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\" \/ \"<\/code> + secondNode.getClass().getName());<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>AnnotationNode rolesAnnotationNode = (AnnotationNode) firstNode;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>AnnotatedNode annotatedNode = (AnnotatedNode) secondNode;<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>AnnotationNode secured = createAnnotation(rolesAnnotationNode);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (secured != <\/code>null<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>annotatedNode.addAnnotation(secured);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>catch<\/code> (Exception e) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ TODO<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>e.printStackTrace();<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0<\/code>protected<\/code> AnnotationNode createAnnotation(AnnotationNode rolesNode)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>throws<\/code> IOException {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>Expression value = rolesNode.getMembers().get(<\/code>\"value\"<\/code>);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (!(value <\/code>instanceof<\/code> ConstantExpression)) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ TODO<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>System.out.println(<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\"annotation @Authorities value isn't a ConstantExpression: \"<\/code> +<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>value);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> null<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>String fieldName = value.getText();<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>String[] authorityNames = getAuthorityNames(fieldName);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (authorityNames == <\/code>null<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> null<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> buildAnnotationNode(authorityNames);<\/code><\/div>\n
\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0<\/code>protected<\/code> AnnotationNode buildAnnotationNode(String[] names) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>AnnotationNode securedAnnotationNode = <\/code>new<\/code> AnnotationNode(SECURED);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>List<Expression> nameExpressions = <\/code>new<\/code> ArrayList<Expression>();<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>for<\/code> (String authorityName : names) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>nameExpressions.add(<\/code>new<\/code> ConstantExpression(authorityName));<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>securedAnnotationNode.addMember(<\/code>\"value\"<\/code>,<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>new<\/code> ListExpression(nameExpressions));<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> securedAnnotationNode;<\/code><\/div>\n
\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0<\/code>protected<\/code> String[] getAuthorityNames(String fieldName)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>throws<\/code> IOException {<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>Properties properties = <\/code>new<\/code> Properties();<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>File propertyFile = <\/code>new<\/code> File(<\/code>\"roles.properties\"<\/code>);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (!propertyFile.exists()) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ TODO<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>System.out.println(<\/code>\"Property file roles.properties not found\"<\/code>);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> null<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>properties.load(<\/code>new<\/code> FileReader(propertyFile));<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>Object value = properties.getProperty(fieldName);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (value == <\/code>null<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>\/\/ TODO<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>System.out.println(<\/code>\"No value for property '\"<\/code> + fieldName + <\/code>\"'\"<\/code>);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> null<\/code>;<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>List<String> names = <\/code>new<\/code> ArrayList<String>();<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>String[] nameArray = StringUtils.commaDelimitedListToStringArray(<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>value.toString())<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>for<\/code> (String auth : nameArray) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>auth = auth.trim();<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>if<\/code> (auth.length() > <\/code>0<\/code>) {<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>names.add(auth);<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>}<\/code><\/div>\n
<\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>return<\/code> names.toArray(<\/code>new<\/code> String[names.size()]);<\/code><\/div>\n
\u00a0\u00a0<\/code>}<\/code><\/div>\n
}<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

I\u2019ll probably include this in the plugin at some point \u2013 I created a JIRA issue<\/a> as a reminder \u2013 but for now you can just copy these two classes into your application\u2019s src\/java folder and create a roles.properties<\/code> file in the project root. Any time you want to add or remove an entry or add or remove a role name from an entry, update the properties file, run grails clean<\/code> and grails compile<\/code> to be sure that the latest values are used.<\/p>\n

Reference: <\/i><\/strong>Make your Spring Security @Secured annotations more DRY<\/a> from our JCG partner<\/a> Burt Beckwith at the An Army of Solipsists<\/a> blog.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying attributes in Java annotations are pretty restrictive, so I couldn\u2019t see a direct way to do what he was asking. Using Groovy doesn\u2019t really help here since for the most part …<\/p>\n","protected":false},"author":164,"featured_media":240,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[343,472,30,125],"class_list":["post-1181","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-java","tag-annotations","tag-dry","tag-spring","tag-spring-security"],"yoast_head":"\nMake your Spring Security @Secured annotations more DRY - Java Code Geeks<\/title>\n<meta name=\"description\" content=\"Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Make your Spring Security @Secured annotations more DRY - Java Code Geeks\" \/>\n<meta property=\"og:description\" content=\"Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html\" \/>\n<meta property=\"og:site_name\" content=\"Java Code Geeks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/javacodegeeks\" \/>\n<meta property=\"article:published_time\" content=\"2012-06-01T01:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-02-14T11:31:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"150\" \/>\n\t<meta property=\"og:image:height\" content=\"150\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Burt Beckwith\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:site\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Burt Beckwith\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html\"},\"author\":{\"name\":\"Burt Beckwith\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/3cf04d9b0a49f04b2576c456befb2446\"},\"headline\":\"Make your Spring Security @Secured annotations more DRY\",\"datePublished\":\"2012-06-01T01:00:00+00:00\",\"dateModified\":\"2019-02-14T11:31:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html\"},\"wordCount\":437,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"keywords\":[\"Annotations\",\"DRY\",\"Spring\",\"Spring Security\"],\"articleSection\":[\"Enterprise Java\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html\",\"name\":\"Make your Spring Security @Secured annotations more DRY - Java Code Geeks\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"datePublished\":\"2012-06-01T01:00:00+00:00\",\"dateModified\":\"2019-02-14T11:31:00+00:00\",\"description\":\"Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#primaryimage\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-logo.jpg\",\"width\":150,\"height\":150,\"caption\":\"spring-interview-questions-answers\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/06\\\/make-your-spring-security-secured.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Java\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/java\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Enterprise Java\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/java\\\/enterprise-java\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Make your Spring Security @Secured annotations more DRY\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"name\":\"Java Code Geeks\",\"description\":\"Java Developers Resource Center\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"alternateName\":\"JCG\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.javacodegeeks.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\",\"name\":\"Exelixis Media P.C.\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"width\":864,\"height\":246,\"caption\":\"Exelixis Media P.C.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/javacodegeeks\",\"https:\\\/\\\/x.com\\\/javacodegeeks\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/3cf04d9b0a49f04b2576c456befb2446\",\"name\":\"Burt Beckwith\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3b5c5b0ec9414f2f4efb0d842d2412851a737fd1da29f3edc67f43d201133b2f?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3b5c5b0ec9414f2f4efb0d842d2412851a737fd1da29f3edc67f43d201133b2f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3b5c5b0ec9414f2f4efb0d842d2412851a737fd1da29f3edc67f43d201133b2f?s=96&d=mm&r=g\",\"caption\":\"Burt Beckwith\"},\"sameAs\":[\"http:\\\/\\\/burtbeckwith.com\\\/blog\\\/\"],\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/author\\\/Burt-Beckwith\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Make your Spring Security @Secured annotations more DRY - Java Code Geeks","description":"Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html","og_locale":"en_US","og_type":"article","og_title":"Make your Spring Security @Secured annotations more DRY - Java Code Geeks","og_description":"Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying","og_url":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html","og_site_name":"Java Code Geeks","article_publisher":"https:\/\/www.facebook.com\/javacodegeeks","article_published_time":"2012-06-01T01:00:00+00:00","article_modified_time":"2019-02-14T11:31:00+00:00","og_image":[{"width":150,"height":150,"url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","type":"image\/jpeg"}],"author":"Burt Beckwith","twitter_card":"summary_large_image","twitter_creator":"@javacodegeeks","twitter_site":"@javacodegeeks","twitter_misc":{"Written by":"Burt Beckwith","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#article","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html"},"author":{"name":"Burt Beckwith","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/3cf04d9b0a49f04b2576c456befb2446"},"headline":"Make your Spring Security @Secured annotations more DRY","datePublished":"2012-06-01T01:00:00+00:00","dateModified":"2019-02-14T11:31:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html"},"wordCount":437,"commentCount":0,"publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","keywords":["Annotations","DRY","Spring","Spring Security"],"articleSection":["Enterprise Java"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html","url":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html","name":"Make your Spring Security @Secured annotations more DRY - Java Code Geeks","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#primaryimage"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","datePublished":"2012-06-01T01:00:00+00:00","dateModified":"2019-02-14T11:31:00+00:00","description":"Recently a user on the Grails User mailing list wanted to know how to reduce repetition when defining @Secured annotations. The rules for specifying","breadcrumb":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#primaryimage","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-logo.jpg","width":150,"height":150,"caption":"spring-interview-questions-answers"},{"@type":"BreadcrumbList","@id":"https:\/\/www.javacodegeeks.com\/2012\/06\/make-your-spring-security-secured.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.javacodegeeks.com\/"},{"@type":"ListItem","position":2,"name":"Java","item":"https:\/\/www.javacodegeeks.com\/category\/java"},{"@type":"ListItem","position":3,"name":"Enterprise Java","item":"https:\/\/www.javacodegeeks.com\/category\/java\/enterprise-java"},{"@type":"ListItem","position":4,"name":"Make your Spring Security @Secured annotations more DRY"}]},{"@type":"WebSite","@id":"https:\/\/www.javacodegeeks.com\/#website","url":"https:\/\/www.javacodegeeks.com\/","name":"Java Code Geeks","description":"Java Developers Resource Center","publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"alternateName":"JCG","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.javacodegeeks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.javacodegeeks.com\/#organization","name":"Exelixis Media P.C.","url":"https:\/\/www.javacodegeeks.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","width":864,"height":246,"caption":"Exelixis Media P.C."},"image":{"@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/javacodegeeks","https:\/\/x.com\/javacodegeeks"]},{"@type":"Person","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/3cf04d9b0a49f04b2576c456befb2446","name":"Burt Beckwith","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3b5c5b0ec9414f2f4efb0d842d2412851a737fd1da29f3edc67f43d201133b2f?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/3b5c5b0ec9414f2f4efb0d842d2412851a737fd1da29f3edc67f43d201133b2f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3b5c5b0ec9414f2f4efb0d842d2412851a737fd1da29f3edc67f43d201133b2f?s=96&d=mm&r=g","caption":"Burt Beckwith"},"sameAs":["http:\/\/burtbeckwith.com\/blog\/"],"url":"https:\/\/www.javacodegeeks.com\/author\/Burt-Beckwith"}]}},"_links":{"self":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/1181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/users\/164"}],"replies":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/comments?post=1181"}],"version-history":[{"count":0,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/1181\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media\/240"}],"wp:attachment":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media?parent=1181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/categories?post=1181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/tags?post=1181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}