Grails: Is the Spring Security Plugin Too Powerful for Simple Security -

we have several grails applications use shared plugin among other things provides them basic security. we're going adding other types of authentication in future idea of using spring security plugin has come up. however, i'm wondering if it's powerful our basic needs.

currently use grails filters run before url accessed , perform security checks. initial authentication handled looking specific encrypted post variable or cookie (being send closed source application) , after decrypting it, verifying details in our database. if checks out consider user logged in (and have numeric user id encrypted data). of users have same access, except small handful have greater access. these defined in table contains numerical id.

however, we're hoping add ability log directly these grails applications using active directory credentials, credentials provided closed sourced system's ldap server, , in not distance future via cas server.

my initial approach libraries allow shared plugin interface these various systems , simple authentication against them. however, noticed spring security seems have plugins these various types of authentication, speed development. however, module seems complex , geared towards more advanced setups means might spend lot of time setting spring security in order save time ldap, cas, etc. plugins.

any thoughts/comments/etc. highly appreciated.

also, if use spring security plugin, please comment , let me know if following kind of setup possible ...

we'd avoid having create database tables various applications authentication purposes. tell spring security if user passed authentication, authenticated. there no roles, no groups, nothing fancy (except few applications have 1 role/group provides user permissions ... these applications database table needed).

we'd default requiring security , add code suppress allow non authenticated access. idea behind in case developer forgets add spring security markup code controller or action default needing authentication.

also we'd still need keep original methods of authentication via en encrypted post variable send application or encrypted cookies. possible build spring security?

and lastly can spring security plugin store numeric user id retrieved after authentication identify user instead storing actual username used during authentication?

well, have quite lot of questions there within post. best answer ones can recall.

firstly, spring security complex. that's because real security hard. however, spring security , extent grails plugin both configurable , customizable. work advantage, once through high learning curve.

you save lot of headaches , in end time , effort investing in spring security now, since requirements growing , becoming more complex.

i recommend reading spring security documentation, spring security grails documentation , many posts tagged spring-security can. wouldn't bad idea invest in few written books covering spring security.

those high level thoughts/comments.

as far possible spring security (your other questions).

1. yes, can setup spring security not use type of database tables.
2. you can write won security authentication filter custom authentication via params/etc.
3. by default locked down in latest grails spring security plugin, , if use intercepturlmap need alter urls have no security or differing security default of is_authenticated_fully.
4. using custom userdetailsservice , userdetails can use numeric id or other details want within principal.

to summarize, right effort , understanding of spring security can make address needs. however, it's not short , quick process , require lot of reading.