Spring Security Core Plugin - Basic auth for rest url

Discussion:

Ingo Busse

2010-07-09 15:45:47 UTC

Tried to configure a basic auth filter for a specific url by

- setting grails.plugins.springsecurity.filterChain.chainMap in Config.groovy
- configuring a basicAuthenticationFilter in resources.groovy

This results in a No bean named ... Exception. It seems that it tries to resolve the chain before the beans in resources groovy are constructed.

Any idea how to resolve this?

Thanx,
Ingo

BTW, I do have a working solution for the acegi plugin doing all the work in resource.groovy.

Burt Beckwith

2010-07-09 16:07:55 UTC

Permalink

You shouldn't need to do anything in resources.groovy, just add

grails.plugins.springsecurity.useBasicAuth = true

to Config.groovy as described in section 9.1 of the docs: http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/

Burt

Post by Ingo Busse
Tried to configure a basic auth filter for a specific url by
- setting grails.plugins.springsecurity.filterChain.chainMap in Config.groovy
- configuring a basicAuthenticationFilter in resources.groovy
This results in a No bean named ... Exception. It seems that it tries to resolve the chain before the beans in resources groovy are constructed.
Any idea how to resolve this?
Thanx,
Ingo
BTW, I do have a working solution for the acegi plugin doing all the work in resource.groovy.

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email

Ingo Busse

2010-07-09 16:20:43 UTC

Permalink

But I do not want the whole application to use Basic Authentication but just the rest api urls, e.g. /<app>/rest/**
while the rest of the application uses form based authentication.

----- Original Message -----
From: "Burt Beckwith" <***@burtbeckwith.com>
To: ***@grails.codehaus.org
Sent: Friday, July 9, 2010 6:07:55 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna
Subject: Re: [grails-user] Spring Security Core Plugin - Basic auth for rest url

You shouldn't need to do anything in resources.groovy, just add

grails.plugins.springsecurity.useBasicAuth = true

to Config.groovy as described in section 9.1 of the docs: http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/

Burt

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email

Burt Beckwith

2010-07-09 16:26:26 UTC

Permalink

Right - so keep the grails.plugins.springsecurity.filterChain.chainMap in Config.groovy, that's what it's for.

Burt

Post by Ingo Busse
But I do not want the whole application to use Basic Authentication but just the rest api urls, e.g. /<app>/rest/**
while the rest of the application uses form based authentication.
----- Original Message -----
Sent: Friday, July 9, 2010 6:07:55 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna
Subject: Re: [grails-user] Spring Security Core Plugin - Basic auth for rest url
You shouldn't need to do anything in resources.groovy, just add
grails.plugins.springsecurity.useBasicAuth = true
to Config.groovy as described in section 9.1 of the docs: http://burtbeckwith.github.com/grails-spring-security-core/docs/manual/
Burt

---------------------------------------------------------------------
http://xircles.codehaus.org/manage_email

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email

Ingo Busse

2010-07-09 17:14:26 UTC

Permalink

Tried this configuration already: basic authentication filter created by your plugin setting useBasicAuth to true. While the api urls work as expected the other urls as well pop up the basic authentication box. May be the filter chain for /** is wrong!?

grails.plugins.springsecurity.useBasicAuth = true
grails.plugins.springsecurity.basic.realmName = "API"

grails.plugins.springsecurity.filterChain.chainMap = [
'/api/**': 'securityContextPersistenceFilter,logoutFilter,basicAuthenticationFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor',
'/**':'securityContextPersistenceFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeAuthenticationFilter,anonymousAuthenticationFilter,exceptionTranslationFilter,filterInvocationInterceptor'
]

----- Original Message -----
From: "Burt Beckwith" <***@burtbeckwith.com>
To: ***@grails.codehaus.org
Sent: Friday, July 9, 2010 6:26:26 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna
Subject: Re: [grails-user] Spring Security Core Plugin - Basic auth for rest url

Right - so keep the grails.plugins.springsecurity.filterChain.chainMap in Config.groovy, that's what it's for.

Burt

---------------------------------------------------------------------
http://xircles.codehaus.org/manage_email

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email

Burt Beckwith

2010-07-09 19:54:21 UTC

Permalink

I think this is a bug with the AuthenticationEntryPoint but I won't have time to look at it until the weekend. Please create an issue at http://jira.codehaus.org/browse/GRAILSPLUGINS under Grails-Spring-Security-Core so it gets tracked.

Burt

Post by Ingo Busse
Tried this configuration already: basic authentication filter created by your plugin setting useBasicAuth to true. While the api urls work as expected the other urls as well pop up the basic authentication box. May be the filter chain for /** is wrong!?
grails.plugins.springsecurity.useBasicAuth = true
grails.plugins.springsecurity.basic.realmName = "API"
grails.plugins.springsecurity.filterChain.chainMap = [
'/api/**': 'securityContextPersistenceFilter,logoutFilter,basicAuthenticationFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor',
'/**':'securityContextPersistenceFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeAuthenticationFilter,anonymousAuthenticationFilter,exceptionTranslationFilter,filterInvocationInterceptor'
]
----- Original Message -----
Sent: Friday, July 9, 2010 6:26:26 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna
Subject: Re: [grails-user] Spring Security Core Plugin - Basic auth for rest url
Right - so keep the grails.plugins.springsecurity.filterChain.chainMap in Config.groovy, that's what it's for.
Burt

---------------------------------------------------------------------
http://xircles.codehaus.org/manage_email

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email

Ingo Busse

2010-07-09 21:46:07 UTC

Permalink

Checked your source. You are right there is only one 'authenticationEntryPoint' defined that is either form based, basic, digest or x509. So an application can have only one of these. Not really a bug but I created a Jira anyway:

http://jira.codehaus.org/browse/GRAILSPLUGINS-2277

Thanks a lot for your quick hints,
Ingo

----- Original Message -----
From: "Burt Beckwith" <***@burtbeckwith.com>
To: ***@grails.codehaus.org
Sent: Friday, July 9, 2010 9:54:21 PM GMT +01:00 Amsterdam / Berlin / Bern / Rome / Stockholm / Vienna
Subject: Re: [grails-user] Spring Security Core Plugin - Basic auth for rest url

I think this is a bug with the AuthenticationEntryPoint but I won't have time to look at it until the weekend. Please create an issue at http://jira.codehaus.org/browse/GRAILSPLUGINS under Grails-Spring-Security-Core so it gets tracked.

Burt

---------------------------------------------------------------------
http://xircles.codehaus.org/manage_email

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

http://xircles.codehaus.org/manage_email