0

I'm developing a Grails 3 web-app powered with Spring Security plugin, which already makes large use of @Secured annotations to protect controllers and actions according to the privileges of single logged-in users.
The login is currently managed via the usual username/password pair.

Now a new requirement came up, involving a custom request header, having as value a sort of 'authorization token':

  • this token identifies a group of users (let's call it team)
  • if this token is recognized as valid, matching against DB, then the whole application should behave as a predefined user (let's call it John, part of the team) was logged-in. In this sense it should act as a pre-authentication. This user will have his own roles, so the application will respond accordingly, as if John would had logged in with his own username/password.
  • if the token is not recognized, 401 status must be returned.
  • if the token is not passed, the application must have its current behavior, to the token management should be considered optional must not impact the current implementation at all.

I considered defining a custom filter (I also took a look at this post, which however has different requirements), but I cannot even determine:

  • the feasibility of this task
  • whether or not filters are the best approach (but I guess so as Interceptors are triggered too late, and I need some additional logic to be evaluated before Spring Security comes into play)
  • possibly, the best filter to extend

So any suggestion is welcome! Thanks in advance

Community
  • 1
  • 1
ilPittiz
  • 734
  • 1
  • 10
  • 23
  • Have you looked at JWT and spring-security-rest? http://plugins.grails.org/plugin/grails/spring-security-rest – erichelgeson Apr 03 '17 at 15:38
  • Thanks @erichelgeson for your suggestion, but I don't feel like it fits my requirement: when the _team_ token header is present, basically no explicit user authentication should occur (no username/password), while instead the user session for _John_ should be generated automatically. – ilPittiz Apr 03 '17 at 15:47

1 Answers1

0

Not an expert on this, but I would implement a custom UserDetailsService and set the authorities based on the token condition. You might also be able to do it in an AuthenticationSuccessListener.

Jay
  • 173
  • 10