How does Grails integrate with Spring Security?

Grails applications typically add authentication and authorization through the Spring Security plugin, which layers Grails' own conventions (domain classes, controllers, interceptors) on top of the underlying Spring Security framework rather than requiring a developer to configure Spring Security's XML/Java config directly by hand.

1. Add the plugin as a build dependency, which brings in the necessary Spring Security beans pre-wired for a typical Grails setup.
2. Generate the user and role domain classes using the plugin's provided scripts, producing GORM domain classes representing users, roles, and the join table between them — ordinary domain classes a developer can extend like any other.
3. Secure controllers or actions declaratively, either via annotations like @Secured('ROLE_ADMIN') on a controller/action, or through URL-pattern-based security rules configured centrally.
4. Customize login/logout flows and access-denied handling through the plugin's configurable views and controllers, which can be overridden to match an application's actual UI.

Because user and role data end up as regular GORM domain classes, they benefit from the same persistence, validation, and query capabilities as any other part of the domain model — there's no separate, parallel security data store to keep in sync with the rest of the application's data.