Spring Security - How to lock down a specific URL

[Dean Del Ponte-2]

I have a specific controller action which is accessed via AJAX and I would like make it available to users of a certain role.

For example, here is my action:

class MyController {

public def searchAvailableModelNamesAjax(String term) {

        // Do really cool stuff

        // Render really cool stuff

        render "[]"

}

}

It works if I give users with a specific role access to all actions on this controller like this:

new RequestMap(url: "/admin/my/**", configAttribute: "ROLE")

But it doesn't allow access if I do this:

new RequestMap(url: "/admin/my/searchAvailableModelNamesAjax", configAttribute: "ROLE")

All help is appreciated.

Thanks!

Dean Del Ponte

[burtbeckwith]

The url has to be lowercase - searchavailablemodelnamesajax 

Burt

 

On July 18, 2012 at 11:05 AM Dean Del Ponte <[hidden email]> wrote:

> I have a specific controller action which is accessed via AJAX and I would
> like make it available to users of a certain role.
>
> For example, here is my action:
>
> class MyController {
>
> public def searchAvailableModelNamesAjax(String term) {
>         // Do really cool stuff
>         // Render really cool stuff
>         render "[]"
> }
>
> }
>
> It works if I give users with a specific role access to all actions on this
> controller like this:
> new RequestMap(url: "/admin/my/**", configAttribute: "ROLE")
>
> But it doesn't allow access if I do this:
> new RequestMap(url: "/admin/my/searchAvailableModelNamesAjax",
> configAttribute: "ROLE")
>
> All help is appreciated.
>
> Thanks!
>
> Dean Del Ponte

[Octavian Covalschi]

Just a thought. What about  

new RequestMap(url: "/admin/my/searchAvailableModelNamesAjax*", configAttribute: "ROLE") 

or 

new RequestMap(url: "/admin/my/searchAvailableModelNamesAjax**", configAttribute: "ROLE")  

?

On Wed, Jul 18, 2012 at 10:05 AM, Dean Del Ponte <[hidden email]> wrote:

new RequestMap(url: "/admin/my/searchAvailableModelNamesAjax", configAttribute: "ROLE")