How to conditionally skip SecurityContextPersistenceFilter filter in Grails Spring Security Plugin Filter Chain

Question

I have a unique scenario that I am trying to resolve within the limitations of the Spring Security plugin (version 1.2.7.3 if it is currious). I created a custom SSO plugin that allows you to login with a signed URL. The custom plugin works fine, and I added as per the documentation, creating beans in resources.groovy and adding to the filter chain in BootStrap.groovy.

SpringSecurityUtils.clientRegisterFilter('ssoFilter', SecurityFilterPosition.SECURITY_CONTEXT_FILTER.order + 10) 

Once the user has signed everything, everything works fine, and an existing active session that has been added to the security context authenticates the user.

I have a use case when it is possible that a user who has already authenticated can return to the same browser (i.e. the same session cookie) with another user at the request of SSO. I would like the filter chain to notice "sso = true" in the URL query string.

The behavior that I see now is that SSO is never achieved because the original user is already authenticated by the security context. I cannot add an SSO filter before the SecurityContextPersistenceFilter , as this causes problems where the SSO filter constantly gets in and nothing is actually displayed. This follows the documents in which I saw that you should not place filters in front of the security context filter.

I learned how to create a custom filter chain specifically for URLs with "sso = true" (something I do during a non-authenticated stream by adding a custom RequestMatcher and AuthenticationEntryPoint implementation of DelegatingAuthenticationEntryPoint ) using the springsecurity.filterChain.chainMap configuration. However, it can be seen from the documents and experiments that only the path is filtered.

Is there a way to ensure that whenever "sso = true" is displayed in the URL, that the SSO filter is hit when available in the security context, or that the SecurityContextPersistenceFilter can go through the request for the SSO filter?

Answer 1

It seems to me that you can use a custom SecurityContextRepository .

Version 1.2.7.3 Spring The Security Grails plugin appears to be using Spring Security 3.0.7. As described in Spring Security Help topic 8.3.1 , starting with Spring Security 3.0, the SecurityContextPersistenceFilter configured using the SecurityContextRepository bean, which is responsible for loading and saving the SecurityContext . By default, this is an instance of HttpSessionSecurityContextRepository .

You can create a custom class that extends HttpSessionSecurityContextRepository . A custom subclass can override the loadContext (HttpRequestResponseHolder) method to remove the session attribute "SPRING_SECURITY_CONTEXT" if the request contains the query parameter sso=true .

You can view the implementation of HttpSessionSecurityContextRepository in Spring Security 3.0.7 on GitHub:
https://github.com/spring-projects/spring-security/blob/3.0.7.RELEASE/web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java

Related: How can I use Spring Security without sessions?

Answer 2

Daniel, your solution worked. Here is my fragment

 @Override public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) { logger.debug("loadContext entry"); String ssoParameter = requestResponseHolder.getRequest().getParameter("sso"); if (ssoParameter != null && ssoParameter.equalsIgnoreCase("true")) { HttpSession session = requestResponseHolder.getRequest().getSession(false); if (session != null) session.invalidate(); } return super.loadContext(requestResponseHolder); }