title: Grails Acegi security: Problem with roles and access
body: <h1>sad end to this story</h1>
  
  <p>Well, as it turns out, the <code>compareTo</code> method in my Role class (Role implements GrantedAuthority) was returning always 0. So each user had only one role (since they are stored in a Set).</p>
  
  <h1>The problem</h1>
  
  <p>Hi everyone,</p>
  
  <p>I'm having some strange behaviour in my application.</p>
  
  <p>I've added a couple of fields to the User class (created by Acegi), so I can set an expired password, record last N passwords, stuff like that. We have 9 roles, <code>ROLE_ADMIN</code> being the "superuser" that can access all the functionality.</p>
  
  <p>After deploying the app, users started complaining that they can't use it. They are able to login, but whenever they want to go somewhere, they get access denied, as if they didn't have the Role.</p>
  
  <p>This happens on every User, except for the administrator (only has the <code>ROLE_ADMIN</code>), included those with (<code>ROLE_ADMIN</code> + other roles).</p>
  
  <p>I can't even think were to start.</p>
  
  <h1>update</h1>
  
  <p>I've checked and user are coming from the database with the roles attached.</p>
  
  <p>Roles are checked in the SecurityConfig.groovy file. Im afraid that the problem is elsewhere, since I have a tagged version of the project that actually works.</p>
  
  <p>Here's my SecurityConfig.groovy:</p>
  
  <pre><code>import com.mycompany.myapp.audit.Auditoria
  
  security {
  
      // see DefaultSecurityConfig.groovy for all settable/overridable properties
  
      active = true
  
      loginUserDomainClass = "com.mycompany.myapp.user.User"
      authorityDomainClass = "com.mycompany.myapp.user.Role"
      requestMapClass = "com.mycompany.myapp.user.Requestmap"
  
      useRequestMapDomainClass = false
  
      /** authenticationEntryPoint */
      loginFormUrl = '/login/auth'
      forceHttps = 'false'
      ajaxLoginFormUrl = '/login/authAjax'
      authenticationFailureUrl = '/login/authfail'
  
  
      afterLogoutUrl = '/login/auth'
  
      requestMapString = """\
              CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
              PATTERN_TYPE_APACHE_ANT
  
              /=IS_AUTHENTICATED_REMEMBERED
              /login/auth=IS_AUTHENTICATED_ANONYMOUSLY
              /login/authajax=IS_AUTHENTICATED_ANONYMOUSLY
              /login/authfail=IS_AUTHENTICATED_ANONYMOUSLY
              /login/renew=IS_AUTHENTICATED_ANONYMOUSLY
              /js/**=IS_AUTHENTICATED_ANONYMOUSLY
              /css/**=IS_AUTHENTICATED_ANONYMOUSLY
              /images/**=IS_AUTHENTICATED_ANONYMOUSLY
              /plugins/**=IS_AUTHENTICATED_ANONYMOUSLY
  
  
              /scan/uploadfile=IS_AUTHENTICATED_ANONYMOUSLY
              /ticket/uploadfile=IS_AUTHENTICATED_ANONYMOUSLY
              /analisis/list =ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_OP_FUNCIONAL, ROLE_ADMIN
              /analisis/hazzards/**=ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_OP_FUNCIONAL, ROLE_ADMIN
              /analisis/show/**=ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_ADMIN
              /analisis/create/**=ROLE_SUP_TECNICO, ROLE_ADMIN
              /analisis/edit/**=ROLE_SUP_TECNICO,ROLE_ADMIN
              /hazzardsreport/**=ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_OP_FUNCIONAL, ROLE_REPORTE_VULNERABILIDAD, ROLE_ADMIN
              /mistaken/**=ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_ADMIN
              /hazzardtype/**=ROLE_SUP_TECNICO, ROLE_ADMIN
  
              /** MODULO NORMAS */
              /report/**=ROLE_OP_FUNCIONAL, ROLE_ADMIN
              /norm/**=ROLE_OP_FUNCIONAL, ROLE_ADMIN
  
              /** TICKETS */
              /ticket/**=ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_ADMIN
              /alert/**=ROLE_SUP_TECNICO, ROLE_OP_TECNICO, ROLE_ADMIN
              /ticket/uploadfile=IS_AUTHENTICATED_ANONYMOUSLY
  
              /** RISKS */
              /project/**=ROLE_AN_RIESGOS, ROLE_ADMIN
              /riskreport/**=ROLE_AN_RIESGOS, ROLE_ADMIN, ROLE_REPORTE_RIESGO
  
          /** BUSINESS CONTINUITY*/
              /projectpcn/**=ROLE_AN_PCN, ROLE_ADMIN
          /businessuniteval/** = ROLE_AN_PCN, ROLE_ADMIN
          /subprocesseval/** = ROLE_AN_PCN, ROLE_ADMIN
          /failscenario/**=ROLE_AN_PCN, ROLE_ADMIN
          /strategy/**=ROLE_AN_PCN, ROLE_ADMIN
          /test/**=ROLE_AN_PCN, ROLE_ADMIN
          /reportepcn/**=ROLE_AN_PCN, ROLE_ADMIN, ROLE_REPORTE_PCN
          /process/**=ROLE_AN_PCN, ROLE_ADMIN
  
  
          /** ADMIN */
              /user/changeent=IS_AUTHENTICATED_REMEMBERED
              /user/finduser=IS_AUTHENTICATED_REMEMBERED
              /user/**=ROLE_ADMIN
              /role/**=ROLE_ADMIN
              /requestmap/**=ROLE_ADMIN
          /empresa/**=ROLE_ADMIN
          /asset/**=ROLE_ADMIN, ROLE_SUP_TECNICO, ROLE_OP_TECNICO
          /responsable/**=ROLE_ADMIN
          /preference/**=ROLE_ADMIN
          /businessunit/**=ROLE_ADMIN, ROLE_AN_PCN
  
  
              /**=IS_AUTHENTICATED_REMEMBERED
          """
  
  
      useSecurityEventListener = true
  
      onInteractiveAuthenticationSuccessEvent = { e, appCtx -&gt;
          Auditoria.log(e.getSource().getPrincipal().getDomainClass(), "Usuario autenticado - " + e.getSource().getDetails().getRemoteAddress())
      }
  
  }
  </code></pre>
  
  <h1>update - log verbosity and no comments/newlines</h1>
  
  <p>Hi, after updating my <code>SecurityConfig.groovy</code>, the error continues. 
  However, I've retrived this log line. I tried to access <code>/norm/index</code> with a user that has all 9 roles assigned to them.</p>
  
  <blockquote>
    <p>DEBUG 28/Dec/2010 00:12:57,110
    [http-8080-3]  Secure object: FilterInvocation: URL: /norm/index; ConfigAttributes: [ROLE_OP_FUNCIONAL,ROLE_ADMIN]</p>
    
    <p>org.springframework.security.intercept.AbstractSecurityInterceptor
    - Previously Authenticated: org.springframework.security.providers.UsernamePasswordAuthenticationToken@a00c7ad6:
    Principal:
    com.baufest.insside.security.UserLoginDetails@0:</p>
    
    <p>Username: someuser; Password:[PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true;
    AccountNonLocked: true; Granted
    Authorities: ROLE_OP_TECNICO;
    Password: [PROTECTED];
    Authenticated: true;</p>
    
    <p>Details: org.springframework.security.ui.WebAuthenticationDetails@0: Granted Authorities: ROLE_OP_TECNICO</p>
    
    <p>DEBUG 28/Dec/2010 00:12:57,110
    [http-8080-3]
    org.springframework.security.ui.ExceptionTranslationFilter
    - Access is denied (user is not anonymous); delegating to
    AccessDeniedHandler</p>
  </blockquote>
  
  <p>For what I read here, it seems that my User is only getting 1 role, even though when I debug it, user.authorities has all 9 roles assigned to it.</p>
  
  <p>Any thoughts will be appreciated
  Thanks in advance.</p>