BT

Article: Securing a Grails Application with Acegi Security

by Ryan Slobojan on Feb 26, 2008 |

In this article, Fadi Shami gives a walkthrough of integrating the grails-acegi plugin with a sample Grails application. As part of this integration, there are three major components which are used – Groovy, Grails and Acegi Security. The article guides the reader through the initial RaceTrack sample application setup, shows how to install the Grails-Acegi plugin into Grails, creates the Acegi security infrastructure, configures Acegi Security to protect the RaceTrack application, and finally tests that the security system is working as expected.

From the article's introduction:

This article assumes that you have completed the Grails tutorial found in Getting Started with Grails by Jason Rudolph, and have implemented the RaceTrack sample application. The grails-acegi plugin will then be integrated with RaceTrack to provide security for your application. Utilizing the grails-acegi plugin avoids the overhead of having to implement Grails interceptors in your application, provides more flexibility than interceptors, and also saves reimplementing your own security system by leveraging Acegi.

Read the full article here.

Hello stranger!

You need to Register an InfoQ account or to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Tell us what you think

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Problem with acegi when configuring pooled=true in Datasource.groovy by Franz Schmid

Hi,

first of all thank you very much for your (even for a newbie like me) easily understandable explanation.

First I got the example to work without problems. But to get better performance i wanted to have my database connections pooled. So I configured pooled=true in Datasource.groovy. As soon as i did this I could only call a few pages before the application stopped responding. After looking at debug output i think the reason is that acegi is waiting for getting another connection from connection pool.

Here are the last debug output statements:

org.acegisecurity.ui.WebAuthenticationDetails@255f8: RemoteIpAddress: 127.0.0.1; SessionId: 1raoz7gc3n0mf; Granted Authorities: ROLE_ANONYMOUS'
org.acegisecurity.providers.anonymous.AnonymousProcessingFilter Populated SecurityContextHolder with anonymous token: 'org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken@90572420: Username: anonymousUser; Password: [PROTECTED]; Authenticated: true; Details: org.acegisecurity.ui.WebAuthenticationDetails@255f8: RemoteIpAddress: 127.0.0.1; SessionId: 1raoz7gc3n0mf; Granted Authorities: ROLE_ANONYMOUS'
org.acegisecurity.util.FilterChainProxy /customer/list at position 7 of 8 in additional filter chain; firing Filter: 'org.acegisecurity.ui.ExceptionTranslationFilter@697087'
org.acegisecurity.util.FilterChainProxy /customer/list at position 7 of 8 in additional filter chain; firing Filter: 'org.acegisecurity.ui.ExceptionTranslationFilter@697087'
org.acegisecurity.util.FilterChainProxy /customer/list at position 8 of 8 in additional filter chain; firing Filter: 'org.acegisecurity.intercept.web.FilterSecurityInterceptor@5acf13'
org.acegisecurity.util.FilterChainProxy /customer/list at position 8 of 8 in additional filter chain; firing Filter: 'org.acegisecurity.intercept.web.FilterSecurityInterceptor@5acf13'
org.hibernate.impl.SessionImpl opened session at timestamp: 4933924451647488
org.hibernate.jdbc.AbstractBatcher about to open PreparedStatement (open PreparedStatements: 0, globally: 0)
org.hibernate.jdbc.ConnectionManager opening JDBC connection

I seached and posted in grails user maillist, unfortunately without result.
Do you know about this problem?

Are you missing the AuthenticateService object? by ed young

I went through the article and put it to use in several apps.

I think the plugin is missing the AuthenticateService.groovy file. Because of this, you can't register a new user.

Am I missing something?

Thanks

Re: Are you missing the AuthenticateService object? by Fadi Shami

Not sure about the problem that your are having , but the plugin has the AuthenticateService.groovy. You should be able to find it in
%your application dir%\plugins\acegi-0.2\grails-app\services

Use lowercase in the RequestMapper URL patterns by John Lindwall

I loosely followed this excellent tutorial but instead of using the race/register controllers I used my own. The URL of my controller includes an uppercase letter, e.g. "purchaseOrder".

If you configure the Requestmap using mixed-case then the Acegi will fail to patern-match that URL, and hence fail to protect those pages.

e.g. /purchaseOrder/**

By enabling Acegi debugging I could see that Acegi was configured to convert all URLs to lowercase before attempting pattern matching. To fix this problem, I used lowercase URL patterns in the Requestmap and it worked great.

e.g. /purchaseorder/**

Thanks for the excellent tutorial!

Re: Use lowercase in the RequestMapper URL patterns by Franz Schmid

Thanks for the help. AuthenticateService.groovy is there in plugins directory.

I tried some more things and found out that if I use static requestMapString instead of useRequestMapDomainClass it works fine with my pooled datasource.

So it seems to me that there is a problem in data access (perhaps release of connections not correctly implemented) when loading database contents of table requestmap.

Re: Are you missing the AuthenticateService object? by Chen Jianfeng

Under %your application dir%\plugins\acegi-0.2\grails-app\services,I find no
AuthenticateService.groovy.But now I can register new users.

When trying to grails generate-registration,I can't get connection to Internet because I use the compus net and download jars then put them into lib file.First time I also could not register users.

And now I am confused.

Authentication with Active Directory by Cross World

Hi,

Thank you very much for your easily understandable tutorial.

Is there also any solution, to authenticate users from an Active Directory.
Can you tell me how to inplement that with grails or do you know any tutorials?

greets

Re: Are you missing the AuthenticateService object? by Chen Jianfeng

I have found the AuthenticateService.groovy in plugin directory.
Thanks!

BeanCreationException by Heidi Nuhm

Hi,
I've installed acegi in my application and have generated the domains, managers und registration. But when I try to compile and restart my Application, I got a BeanCreationException. I had to import the AuthenticateService manual. And there are errors in my Logincontroller like it doesn't find the imported packages.
Can anybody help me?

How can I add new fields to AuthUser / User? Why 2 types of users? by Bob Bowen

I am trying to add some additional fields to my user forms. I did so by editing AuthUser.groovy and adding them. I then ran grails generate-all AuthUser and it created the new create, and edit gsps.

But the problem is:
1. In the tutorial UserController is used, NOT AuthUserController. When I go to create a new User using UserController my new fields aren't there. How can I get Grails to generate my gsp's for user?

2. If I instead use the AuthUser controller, my new fields show up but the password doesn't save correctly. This is because AuthUserController doesn't have hardly any of the code UserController has, such as ciphering the password. Also, roles don't show up in the page, and I imagine won't be saved if I stick them there by hand.

I am not sure what the difference is between AuthUser and User but there is only one domain object, AuthUser, and only one table, auth_user. So if I want to add additional fields do I edit the AuthUser domain object but then edit by hand user/create.gsp, user/edit.gsp?

Thanks,
Bob

UrlMapping to redirect Error to a custom view throws IllegalStateException by Stefan Maiwald

First of all, thanks for that helpful tutorial.

As far as described, I was able to follow and to make it work. Even the basic tutorial at the grails.org site works.

The next step I try to redirect to a more user friendly view when the HTTP Error 403 comes via UrlMappings.groovy like:


class UrlMappings {

static mappings = {
"/$controller/$action?/$id?"{

constraints { }

}

"500"(view:'/error')

"401"(view:'/error/unauthorized')

"403"(view:'/error/forbidden')

}

}


But this leads to an Exception:

...
Nested in org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.IllegalStateException: No thread-bound request found: Are you referring to request attributes outside of an actual web request, or processing a request outside of the originally receiving thread? If you are actually operating within a web request and still receive this message, your code is probably running outside of DispatcherServlet/DispatcherPortlet: In this case, use RequestContextListener or RequestContextFilter to expose the current request
...


Seems that there's something missing?

Cheers

Stefan

Re: Problem with acegi when configuring pooled=true in Datasource.groovy by Stefan Maiwald

Hello Franz,

I discovered the same problem in a similar environment.
Seems like a bug.



Cheers

S.

Re: How can I add new fields to AuthUser / User? Why 2 types of users? by yang poplar

after you modify your authUser, use "grails generate-manager" to complete your user contoll.

Using Existing Acegi Components with Grails acegi plug in by Chawki Mguedmini

First of all, thank you for this excellent tutorial.

I want to know if is't possible to use an already existing Acegi Components with the Grails acegi plugin and how.

Thanks in advance

Chawki

Some tips on Acegi and OpenId by Rajiv Narula

I faced some issues while implementing OpenId with Acegei
See my post below

www.rajivnarula.com/blog/2009/11/16/grails-and-...

HTH

Dynamic Redirection issue by Pooja bawa

Hi,

I am stuck on dynamically redirecting user to original page after redirect to Login page, please let through example.

Regards

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

16 Discuss

Educational Content

General Feedback
Bugs
Advertising
Editorial
InfoQ.com and all content copyright © 2006-2013 C4Media Inc. InfoQ.com hosted at Contegix, the best ISP we've ever worked with.
Privacy policy
BT