3

I have split my Grails app into two apps - a customer facing web app and a separate app that hosts a REST api. I am doing this because I'm building an iOS app to go with my web app. My app uses Spring Security and I want to secure the REST api. I've surprisingly found very little information on the proper way to do this. Should I implement oauth with Spring Security, thus making my API app an oauth provider?

Any suggestions would be great.

RyanLynch
  • 2,987
  • 3
  • 35
  • 48
  • 1
    http://stackoverflow.com/questions/11220359/grails-securing-rest-api-with-oauth2-0 http://stackoverflow.com/questions/7095925/grails-and-oauth http://stackoverflow.com/questions/7951313/securing-grails-rest-service-for-use-with-mobile-applications – Gregg Feb 11 '13 at 20:56
  • So basically a complete solution isn't currently available. – RyanLynch Feb 13 '13 at 02:33

2 Answers2

3

Yes, I just did this for another application. You have to tell spring security to behave differently when the REST URLS are accessed.

Add this to your config.groovy

Now you will have two parts of your application that are authenticated in the following manner

a) Anything with /api ( assuming thats how you have your REST set up) in the URL, gets the basic authentication

b) Everything else , goes through the login page.

// making the application more secured by intercepting all URLs 
grails.plugins.springsecurity.useBasicAuth = true
grails.plugins.springsecurity.basic.realmName = " REST API realm"
grails.plugins.springsecurity.securityConfigType = SecurityConfigType.InterceptUrlMap




//Exclude normal controllers from basic auth filter. Just the JSON API is included
grails.plugins.springsecurity.filterChain.chainMap = [
'/api/**': 'JOINED_FILTERS,-exceptionTranslationFilter',
'/**': 'JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter'
]
Abdullah Choudhury
  • 436
  • 3
  • 5
3

I've been working during the last weeks on a plugin that covers exactly what you want to do:

http://grails.org/plugin/spring-security-rest

Have a look at it and let me know if you have any problem.

Álvaro Sánchez-Mariscal
  • 884
  • 7
  • 14
  • While this may theoretically answer the question, [it would be preferable](http://meta.stackoverflow.com/q/8259) to include the essential parts of the answer here, and provide the link for reference. – Bill the Lizard Jun 11 '14 at 11:11