in plugin-core/plugin/src/main/groovy/grails/plugin/springsecurity/SpringSecurityUtils.groovy [774:824]
static void buildFilterChains(SortedMap<Integer, String> filterNames, List<Map<String, ?>> chainMap,
List<GrailsSecurityFilterChain> filterChains, ApplicationContext applicationContext) {
filterChains.clear()
def allConfiguredFilters = [:]
filterNames.each { Integer order, String name ->
def filter = applicationContext.getBean(name)
if (filter instanceof FilterRegistrationBean) {
filter = ((FilterRegistrationBean) filter).filter
}
allConfiguredFilters[name] = (Filter) filter
SpringSecurityUtils.configuredOrderedFilters[order] = (Filter) filter
}
log.trace 'Ordered filters: {}', SpringSecurityUtils.configuredOrderedFilters
if (chainMap) {
for (Map<String, ?> entry in chainMap) {
String value = (entry.filters ?: '').toString().trim()
List<Filter> filters
if (value.toLowerCase() == FILTERS_NONE) {
filters = Collections.emptyList()
}
else if (value.contains('JOINED_FILTERS')) {
// special case to use either the filters defined by conf.filterChain.filterNames or
// the filters defined by config settings; can also remove one or more with a prefix of -
def copy = [:] << allConfiguredFilters
for (item in value.split(',')) {
item = item.toString().trim()
if (item == 'JOINED_FILTERS') continue
if (item.startsWith('-')) {
item = item.substring(1)
copy.remove item
}
else {
throw new IllegalArgumentException("Cannot add a filter to JOINED_FILTERS, can only remove: $item")
}
}
filters = copy.values() as List<Filter>
}
else {
// explicit filter names
filters = value.toString().split(',').collect { String name -> applicationContext.getBean(name, Filter) }
}
filterChains << new GrailsSecurityFilterChain(entry.pattern as String, filters)
}
}
else {
filterChains << new GrailsSecurityFilterChain('/**', allConfiguredFilters.values() as List<Filter>)
}
}