in plugin-core/plugin/src/main/groovy/grails/plugin/springsecurity/ReflectionUtils.groovy [154:183]
static Collection<ConfigAttribute> buildConfigAttributes(Collection<String> tokens, boolean expressions = true) {
Collection<ConfigAttribute> configAttributes = [] as Set
def ctx = getApplication().mainContext
SecurityExpressionHandler expressionHandler = ctx.getBean('webExpressionHandler')
AccessDecisionVoter roleVoter = ctx.getBean('roleVoter')
AccessDecisionVoter authenticatedVoter = ctx.getBean('authenticatedVoter')
for (String token in tokens) {
ConfigAttribute config = new SecurityConfig(token)
boolean supports = !expressions || token.startsWith('RUN_AS') || token.startsWith('SCOPE') ||
supports(config, roleVoter) || supports(config, authenticatedVoter)
if (supports) {
configAttributes << config
}
else {
try {
Expression expression = expressionHandler.expressionParser.parseExpression(token)
configAttributes << new WebExpressionConfigAttribute(expression)
}
catch (ParseException e) {
log.error "\nError parsing expression '$token': $e.message\n", e
throw e
}
}
}
log.trace 'Built ConfigAttributes {} for tokens {}', configAttributes, tokens
configAttributes
}