Grails 2.2集成Spring Security SAML插件出现No thread-bound request found错误求助

Let's break down this issue and walk through targeted fixes tailored to your older Grails 2.2 setup with Spring Security SAML:

What's Causing This Error? #

This exception means your application is trying to access HTTP request-related attributes (like the current user session or request parameters) from a thread that doesn't have an active request bound to it. Common triggers in your setup include:

• Missing Spring request context listeners/filters that maintain request context across threads (critical for SAML's asynchronous assertion processing)
• Version mismatches between Grails 2.2, Spring Security Core, and the SAML plugin
• Code in controllers/services/GSPs that accesses request context outside the main DispatcherServlet thread

Step-by-Step Fixes for Your Setup #

1. Add RequestContextListener to web.xml #

Grails 2.2 doesn't include this listener by default, but Spring Security SAML relies on it to keep request context available across threads. Update your web-app/WEB-INF/web.xml to include:

<listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

This ensures background threads handling SAML responses can access the request context they need.

2. Ensure RequestContextFilter is in Your Security Filter Chain #

Older versions of the SAML plugin might not automatically inject this filter in Grails 2.2. Add it explicitly to your Config.groovy filter chain:

grails.plugins.springsecurity.filterChain.chainMap = [
    '/saml/**': 'requestContextFilter, samlFilter',
    '/**': 'requestContextFilter, securityContextPersistenceFilter, authenticationProcessingFilter, anonymousAuthenticationFilter, exceptionTranslationFilter, filterInvocationInterceptor'
]

This guarantees the request context is bound before any security processing begins.

3. Check for Cross-Thread Request Access in Your Code #

Looking at your repo, scan for places where you might be accessing request context (e.g., RequestContextHolder.getRequestAttributes()) in services or async tasks. If you find such code, wrap it in a request context binding to preserve the thread context:

def requestAttributes = RequestContextHolder.getRequestAttributes()
try {
    // Your code that requires request context
} finally {
    RequestContextHolder.setRequestAttributes(requestAttributes)
}

If possible, avoid accessing request context in non-request threads entirely.

4. Verify Plugin Version Compatibility #

Since you're locked into Grails 2.2, double-check your BuildConfig.groovy uses compatible plugin versions:

• Stick to Spring Security Core 2.0.x (matching your tutorial)
• Use a Spring Security SAML plugin version explicitly built for Grails 2.2 (older versions like 1.0.x are likely required)
  Mismatched versions can silently break request context handling under the hood.

Debugging Tips #

• Enable Spring's DEBUG logging for org.springframework.web.context.request to track when request context is bound/unbound
• Add logging in code paths leading to the error to confirm if the thread is running inside the DispatcherServlet flow

内容的提问来源于stack exchange，提问作者kofhearts