Unfortunately, we could not find a user with this username and password

Question

I installed the Spring Security core 1.2.7.3 plugin on Grails 2.1.1 , ran the s2-quickstart command, and then initialized the initial user and roles in bootstrap.groovy, but I still can’t log in. The text of the corresponding BootStrap.groovy follows:

  if (SecRole.count == 0) { def fUserRole = SecRole.findByAuthority('ROLE_FlowUser') ?: new SecRole(authority: 'ROLE_FlowUser').save(failOnError: true, flush: true) def fAdminRole = SecRole.findByAuthority('ROLE_FlowAdmin') ?: new SecRole(authority: 'ROLE_FlowAdmin').save(failOnError: true, flush: true) def bf = SecUser.findByUsername('bill') ?: new SecUser( username: 'bill', password: 'eagle', firstName: 'bill', lastName: 'fly', email: ' [e-mail] ', accountExpired: false, accountLocked: false, passwordExpired: false, enabled: true ).save(failOnError: true, flush: true) if (!bf.authorities.contains(fAdminRole)) { SecUserSecRole.create bf, fAdminRole, true } if (!bf.authorities.contains(fUserRole)) { SecUserSecRole.create bf, fUserRole, true } } 

I do not encrypt the password in bootstrap, as it seems, is the answer to most questions of this type. All four entries are written to the database tables, but, of course, I can’t say if the password is encrypted correctly. My initial controller has the following annotation before the class expression:

 @Secured(['IS_AUTHENTICATED_FULLY']) 

In addition, I added the following to config.groovy:

// Added Spring Security Core plugin:

 grails.plugins.springsecurity.userLookup.userDomainClassName = 'cocktail.SecUser' grails.plugins.springsecurity.userLookup.authorityJoinClassName = 'cocktail.SecUserSecRole' grails.plugins.springsecurity.authority.className = 'cocktail.SecRole' grails.plugins.springsecurity.password.algorithm = 'SHA-256' 

Answer 1

Your password can be encoded twice (a problem may occur if you use multi-page data sources).

Try the following:

 class User { ... transient bEncoded = false ... protected void encodePassword() { if (!bEncoded ) { password = springSecurityService.encodePassword(password); bEncoded = true; } } } 

Answer 2

I assume that the authorities.contains check fails due to the lack of hashCode and equals methods in your role class. But if there are no roles (your 1st check), then the user would not have any rights, so you can simply remove these checks:

 SecUserSecRole.create bf, fAdminRole, true SecUserSecRole.create bf, fUserRole, true 

If this is not fixed, it is most likely a problem with password encoding - add a debug log for Spring Security, and it should show you why it does not work; add debug 'org.springframework.security' to the debug 'org.springframework.security' block in Config.groovy

ps if (SecRole.count == 0) { should be if (SecRole.count() == 0) { or just if (!SecRole.count()) {