How to configure grails / spring authentication scheme for each url?

Question

How to configure grails application with Spring Security so that one set of URLs redirects unauthorized users to a user login form with an HTTP 200 response code, while another set of URLs implements calm web services and should return a 401 / unauthorized response for failed checking clients so that the client application can send a request with a username and password in response to 401.

My current configuration can handle the first case with a custom login form. However, I need to configure a different authentication type for the residual URL while maintaining the current behavior for the user interface.

Thanks!

Answer 1

If I understand correctly what you want to do, I have the same problem before! but it's easy to solve using the Spring Grails Security Plugin ! So, first of all, you must configure the application to use basic authentication:

grails.plugins.springsecurity.useBasicAuth = true 

So, your sedative services will try to log in, and if it does not work, it will go to 401! It's easy, but you also need to use a custom login form ?! That way, you can simply set up some kind of URL to enter your normal login strategy as follows:

 grails.plugins.springsecurity.filterChain.chainMap = [ '/api/**': 'JOINED_FILTERS,-exceptionTranslationFilter', '/**': 'JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter' ] 

So, we note that above, everything that comes to the URL / api / will use Basic Auth, but everything that does not belong to / api / uses the usual registration form for authentication!

EDIT

For more information see http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/guide/16%20Filters.html

Answer 2

I had the same problem and did not find a good solution for this. I am really looking forward to a clean solution (something in context, like a multi-tenant).

As a result, I manually checked the status and login part for the second system, which should not be redirected to the login page (therefore, I do not use the "Secured" annotation). I did this using springSecurityService.reauthenticate() (for manual login), springSecurityService.isLoggedIn() and manually in each controller for the second system. If it weren’t, I was redirected to a specific page.

I do not know if this work is suitable for your second system.

Answer 3

You must do basic authentication without attack. To do this, make the following changes to your code.
UrlMappings.groovy

 "/api/restLogin"(controller: 'api', action: 'restLogin', parseRequest: true) 

Config.groovy

 grails.plugin.springsecurity.useBasicAuth = true grails.plugin.springsecurity.basic.realmName = "Login to My Site" grails.plugin.springsecurity.filterChain.chainMap = [ '*' : 'statelessSecurityContextPersistenceFilter,logoutFilter,authenticationProcessingFilter,customBasicAuthenticationFilter,securityContextHolderAwareRequestFilter,rememberMeAuthenticationFilter,anonymousAuthenticationFilter,basicExceptionTranslationFilter,filterInvocationInterceptor', '/api/': 'JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter' ] 

resources.groovy

 statelessSecurityContextRepository(NullSecurityContextRepository) {} statelessSecurityContextPersistenceFilter(SecurityContextPersistenceFilter, ref('statelessSecurityContextRepository')) { } customBasicAuthenticationEntryPoint(CustomBasicAuthenticationEntryPoint) { realmName = SpringSecurityUtils.securityConfig.basic.realmName } customBasicAuthenticationFilter(BasicAuthenticationFilter, ref('authenticationManager'), ref('customBasicAuthenticationEntryPoint')) { authenticationDetailsSource = ref('authenticationDetailsSource') rememberMeServices = ref('rememberMeServices') credentialsCharset = SpringSecurityUtils.securityConfig.basic.credentialsCharset // 'UTF-8' } basicAccessDeniedHandler(AccessDeniedHandlerImpl) basicRequestCache(NullRequestCache) basicExceptionTranslationFilter(ExceptionTranslationFilter, ref('customBasicAuthenticationEntryPoint'), ref('basicRequestCache')) { accessDeniedHandler = ref('basicAccessDeniedHandler') authenticationTrustResolver = ref('authenticationTrustResolver') throwableAnalyzer = ref('throwableAnalyzer') } 

CustomBasicAuthenticationEntryPoint.groovy

 public class CustomBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint { @Override public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException { response.sendError(HttpServletResponse.SC_UNAUTHORIZED); } } 

Apicontroller

 @Secured('permitAll') class ApiController { def springSecurityService @Secured("ROLE_USER") def restLogin() { User currentUser = springSecurityService.currentUser println(currentUser.username) } }