The following example shows the problem mocking JSecurity's SecurityUtils.

In the controller action, you have a call to the SecurityUtils:

def myAction = {
...
  SecurityUtils.subject.isAuthenticated()
...
}

Your test class:

class MyTests extends ControllerUnitTestCase {
  def securityMock
  def controller

  protected void setUp() {
      super.setUp()
      securityMock = mockFor(SecurityUtils) 
      securityMock.demand.static.getSubject{-> [isAuthenticated:{false}] as Subject}
      controller = MyController()
 }

  void testOne() {
      controller.myAction()
  }

  void testTwo() {
      controller.myAction()
  }

}

Expectation: Tests succeed, because getSubject() should be mocked for each test with an expectation of one call.

But: First Test succeed, second test fails with: "No more calls to 'getSubject' expected at this point. End of demands."

Workaround: Specify "securityMock.demand.static.getSubject(1..2){-> [isAuthenticated:{false}] as Subject}". Not practical, because setUp() has to have insides about all tests in the class.