plugin/src/docs/miscProperties.adoc

[[miscProperties]]
== Miscellaneous Properties

.Miscellaneous Properties
[cols="30,30,40"]
|====================
| *Property* | *Default Value* | *Meaning*

|active
|`true`
|Whether the plugin is enabled

|printStatusMessages
|`true`
|Whether to print status messages such as "`Configuring Spring Security Core ...`"

|rejectIfNoRule
|`true`
|"`strict`" mode where a request mapping is required for all resources; if `true` make sure to allow `permitAll` for "`/`", "`/js/pass:[**]`", "`/css/pass:[**]`", "`/images/pass:[**]`", "`/login/pass:[**]`", "`/logout/pass:[**]`", and so on

|anon.key
|"`foo`"
|anonymousProcessingFilter key

|atr.anonymousClass
|`grails.plugin.springsecurity.authentication. GrailsAnonymousAuthenticationToken`
|Anonymous token class

|useHttpSession EventPublisher
|`false`
|If `true`, an {apidocs}org/springframework/security/web/session/HttpSessionEventPublisher.html[HttpSession EventPublisher] will be configured

|cacheUsers
|`false`
|If `true`, logins are cached using an `EhCache`. See "`Account Locking and Forcing Password Change`", under "`User Cache`": <<locking>>

|useSecurity EventListener
|`false`
|If `true`, configure `SecurityEventListener`. See <<events>>

|dao.reflectionSaltSourceProperty
|_none_
|Which property to use for the reflection-based salt source. See <<salt>>

|dao.hideUserNotFoundExceptions
|`true`
|if `true`, throws a new `BadCredentialsException` if a username is not found or the password is incorrect, but if `false` re-throws the `UsernameNot FoundException` thrown by `UserDetailsService` (considered less secure than throwing `BadCredentialsException` for both exceptions)

|requestCache.createSession
|`true`
|Whether caching `SavedRequest` can trigger the creation of a session

|roleHierarchy
|_none_
|Hierarchical role definition. See <<hierarchicalRoles>>

|voterNames
|`['authenticatedVoter', 'roleVoter', 'closureVoter']`
|Bean names of voters. See <<voters>>

|providerNames
|`['daoAuthenticationProvider', 'anonymousAuthenticationProvider', 'rememberMeAuthenticationProvider']`
|Bean names of authentication providers. See <<authenticationProviders>>

|securityConfigType
|"`Annotation`"
|Type of request mapping to use, one of "`Annotation`", "`Requestmap`", or "`InterceptUrlMap`" (or the corresponding enum value from `SecurityConfigType`). See <<requestMappings>>

|controllerAnnotations.lowercase
|`true`
|Whether to do URL comparisons using lowercase

|controllerAnnotations.staticRules
|_none_
|Extra rules that cannot be mapped using annotations

|interceptUrlMap
|_none_
|Request mapping definition when using "`InterceptUrlMap`". See <<configGroovyMap>>

|registerLoggerListener
|`false`
|If `true`, registers a {apidocs}org/springframework/security/access/event/LoggerListener.html[LoggerListener] that logs interceptor-related application events

|scr.allowSessionCreation
|`true`
|Whether to allow creating a session in the `securityContextRepository` bean

|scr.disableUrlRewriting
|`true`
|Whether to disable URL rewriting (and the jsessionid attribute)

|scr.springSecurityContextKey
|`HttpSessionSecurityContextRepository. SPRING_SECURITY_CONTEXT_KEY`
|The HTTP session key to store the `SecurityContext` under

|scpf.forceEagerSessionCreation
|`false`
|Whether to eagerly create a session in the `securityContextRepository` bean

|sch.strategyName
|`SecurityContextHolder.MODE_THREADLOCAL`
|The strategy to use for storing the `SecurityContext` - can be one of `MODE_THREADLOCAL`, `MODE_INHERITABLETHREADLOCAL`, or `MODE_GLOBAL`, or the name of a class implementing {apidocs}org/springframework/security/core/context/SecurityContextHolderStrategy.html[SecurityContextHolderStrategy]

|debug.useFilter
|`false`
|Whether to use the `DebugFilter` to log request debug information to the console

|providerManager.eraseCredentialsAfterAuthentication
|`true`
|Whether to remove the password from the `Authentication` and its child objects after successful authentication

|====================