Quick Spring Security ACL/Event question

[virtualdogbert]

So looking into the spring security plugin I see that there are events that you can register for with closures and handle them how you wish and I like that approach as an option.  What I'm wondering does the ACL sub-plug-in trigger events from it's annotations, that can be dealt with in that same fashion, out of the box or with a simple config.

From what I see in the ACL plug-in documentation it points to using the ErrorController design, for handling errors, which I'm not in favor of because of the noise that it would add to my error logs, because I may or may not want to log, a particular permission denied exception/event.

I'm still looking through spring documentation/api to see if this is possible, but I haven't seen a concrete answer yet, so if you know something about it I would appreciate it.

[virtualdogbert]

To answer my own question , yes and no.  Yes the ACL's trigger events that can be caught by the events closures that the spring security plugin provides.  However it seems for my purposes this isn't very useful since from the closure I can't render a response or redirect to another controller, so I still have to deal with the exception that the ACL's raise in the controller, unlike the @secure annotations, that end up going to the login controller's ajaxDenied action.


To see/catch  these events you could do something like this:
grails.plugins.springsecurity.useSecurityEventListener = true

grails.plugins.springsecurity.onAuthorizationEvent = { e, appCtx ->
   // handle AuthorizationEvent
    if (e instanceof  AuthorizationFailureEvent && e.authentication.principal!= "anonymousUser"){
        //do something here
    }
}