基于Grails 2.2+Spring Security，如何通过MySQL注销指定/所有用户？

Absolutely, you can revoke user access by modifying your MySQL database when using Grails 2.2 with Spring Security—but there are important nuances depending on whether you're targeting a single user or all users, plus how active sessions are handled. Let's break this down:

If you just want to lock a user out without deleting their data, the standard Spring Security approach is to toggle their enabled status in the user table (usually named user or users):

UPDATE user SET enabled = 0 WHERE username = 'target_username';

This prevents them from logging in again, but keeps their account and related data intact.

If you need to fully remove the user, you'll need to clean up related records first (like roles in a user_role join table) to avoid foreign key errors:

-- Delete role associations first
DELETE FROM user_role WHERE user_id = (SELECT id FROM user WHERE username = 'target_username');
-- Then delete the user record
DELETE FROM user WHERE username = 'target_username';

Important: If the user is currently logged in, updating/deleting their database entry won't kick them out immediately. They'll remain authenticated until their session expires or you manually invalidate it using Spring Security's session registry in your Grails code.

To disable every user at once (keeping their data):

UPDATE user SET enabled = 0;

If you need to wipe all user data entirely:

-- Clear role associations first
DELETE FROM user_role;
-- Then delete all user records
DELETE FROM user;

Again, active sessions will persist unless you invalidate them. For a full immediate logout of all users, restarting your Grails app will clear in-memory sessions (though this is a drastic step—only use it if necessary).

• Data Integrity: Always respect foreign key constraints. Skipping related records (like user roles or custom user data) will throw database errors.
• Session Storage: Grails 2.2 might store sessions in memory or a persistent store (like the database itself). If sessions are persisted, you'll need to clear those too to fully log users out right away. Check your Config.groovy for session settings.
• Best Practice: While direct SQL works, it's better to use Grails domain methods (e.g., User.findByUsername('target_username').delete()) when possible. These methods handle cascading deletes and any business logic tied to user removal automatically—direct database edits should be reserved for emergencies or one-off tasks.

内容的提问来源于stack exchange，提问作者kofhearts