AuthService.isUserInRole doesn't ensure grailsApplication.config.security.cas.bypass is a boolean

[sbearcsiro]

The auth service doesn't check that the grailsApplication.config.security.cas.bypass property is a boolean. This causes the truthy value of the value to be used instead. Which means that adding this in an external properties file:

security.cas.bypass=false

In a config file will actually bypass the user in role check because "false" is true.

[aruizca]

I just run into this error. The problem is actually in the doWithWebDescriptor closure when configuring the filter initialization parameters:

                'init-param' {
                    'param-name' ('disableCAS')
                    'param-value' (Holders.config.security.cas.bypass == true ? 'true' : 'false')
                }

Holders.config.security.cas.bypass is a String, so it is always evaluated to false.

[aruizca]

as @sbearcsiro says there is also a bug in AuthService.groovy
I will have a PR ready shortly