为什么我不能使用grails framework 1.3.7中安装的spring security和weceem插件登录？

Question

我正在使用weceem 1.0RC2、spring-security-core 1.1.3、spring-security-ui 0.1.2、weceem-spring-security 1.0及其依赖项安装一个几乎干净的grails 1.3.7项目。

除了用户登录之外，一切都很正常。当我想通过http://localhost:8080/appname/login登录时，我只得到以下错误消息：

Sorry, we were not able to find a user with that username and password.

但是该用户仍然存在于数据库中，如果我使用由spring-security-ui创建的用户，我会得到相同的错误消息。为了对密码进行编码，我使用springSecurityService.encodePassword('password').LoginController是由spring-security (S2-快速入门)生成的。

我认为weceem - spring-security桥可能有问题，你的看法是什么？

致以最好的问候，whitenexx

import grails.converters.JSON
import javax.servlet.http.HttpServletResponse
import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils
import org.springframework.security.authentication.AccountExpiredException
import org.springframework.security.authentication.CredentialsExpiredException
import org.springframework.security.authentication.DisabledException
import org.springframework.security.authentication.LockedException
import org.springframework.security.core.context.SecurityContextHolder as SCH
import org.springframework.security.web.WebAttributes
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter

class LoginController {

/**
 * Dependency injection for the authenticationTrustResolver.
 */
def authenticationTrustResolver

/**
 * Dependency injection for the springSecurityService.
 */
def springSecurityService

/**
 * Default action; redirects to 'defaultTargetUrl' if logged in, /login/auth otherwise.
 */
def index = {
    if (springSecurityService.isLoggedIn()) {
        redirect uri: SpringSecurityUtils.securityConfig.successHandler.defaultTargetUrl
    }
    else {
        redirect action: auth, params: params
    }
}

/**
 * Show the login page.
 */
def auth = {

    def config = SpringSecurityUtils.securityConfig

    if (springSecurityService.isLoggedIn()) {
        redirect uri: config.successHandler.defaultTargetUrl
        return
    }

    String view = 'auth'
    String postUrl = "${request.contextPath}${config.apf.filterProcessesUrl}"
    render view: view, model: [postUrl: postUrl,
                rememberMeParameter: config.rememberMe.parameter]
}

/**
 * The redirect action for Ajax requests. 
 */
def authAjax = {
    response.setHeader 'Location', SpringSecurityUtils.securityConfig.auth.ajaxLoginFormUrl
    response.sendError HttpServletResponse.SC_UNAUTHORIZED
}

/**
 * Show denied page.
 */
def denied = {
    if (springSecurityService.isLoggedIn() &&
    authenticationTrustResolver.isRememberMe(SCH.context?.authentication)) {
        // have cookie but the page is guarded with IS_AUTHENTICATED_FULLY
        redirect action: full, params: params
    }
}

/**
 * Login page for users with a remember-me cookie but accessing a IS_AUTHENTICATED_FULLY page.
 */
def full = {
    def config = SpringSecurityUtils.securityConfig
    render view: 'auth', params: params,
            model: [hasCookie: authenticationTrustResolver.isRememberMe(SCH.context?.authentication),
                postUrl: "${request.contextPath}${config.apf.filterProcessesUrl}"]
}

/**
 * Callback after a failed login. Redirects to the auth page with a warning message.
 */
def authfail = {

    def username = session[UsernamePasswordAuthenticationFilter.SPRING_SECURITY_LAST_USERNAME_KEY]
    String msg = ''
    def exception = session[WebAttributes.AUTHENTICATION_EXCEPTION]
    if (exception) {
        if (exception instanceof AccountExpiredException) {
            msg = SpringSecurityUtils.securityConfig.errors.login.expired
        }
        else if (exception instanceof CredentialsExpiredException) {
            msg = SpringSecurityUtils.securityConfig.errors.login.passwordExpired
        }
        else if (exception instanceof DisabledException) {
            msg = SpringSecurityUtils.securityConfig.errors.login.disabled
        }
        else if (exception instanceof LockedException) {
            msg = SpringSecurityUtils.securityConfig.errors.login.locked
        }
        else {
            msg = SpringSecurityUtils.securityConfig.errors.login.fail
        }
    }

    if (springSecurityService.isAjax(request)) {
        render([error: msg] as JSON)
    }
    else {
        flash.message = msg
        redirect action: auth, params: params
    }
}

/**
 * The Ajax success redirect url.
 */
def ajaxSuccess = {
    render([success: true, username: springSecurityService.authentication.name] as JSON)
}

/**
 * The Ajax denied redirect url.
 */
def ajaxDenied = {
    render([error: 'access denied'] as JSON)
}
}

Answer 1

我刚刚解决了一个症状相同的问题。

事实证明，我的Config.groovy中的映射闭包有一个拼写错误，并且我将一个不存在的字段映射到用户的weceem视图中的“password”字段。

所以插件注入的自定义UserDetailsService就是讨厌我的用户对象，而且什么都不能正常工作。

我在映射的域端将passwd更改为password，以使其与我的User对象中的实际内容相匹配，并且一切正常。

Answer 2

从你提供的一些信息中可以看出这有点棘手。Weceem Spring Security插件将Spring Security Core与Weceem的身份验证机制连接起来。

它通过提供从域类映射到Spring Security Core使用的会话数据对象的自定义UserDetailsService实现来实现这一点。

这个登录URL是否映射到上面详细说明的您自己的登录控制器？weceem-spring- UserDetailsService插件中的安全使用配置的用户域类来调用findByUsername(用户名)：

void afterPropertiesSet() {
    def conf = grailsApplication.config
    def clsname = conf.grails.plugins.springsecurity.userLookup.userDomainClassName
    domainClass = grailsApplication.getDomainClass(clsname).clazz

    def mapper = conf.weceem.springsecurity.details.mapper
    if (!(mapper instanceof Closure)) {
        throw new IllegalArgumentException(
            "Your Config must specify a closure in weceem.springsecurity.details.mapper "+
            "that maps the domain model to a non-domain object, providing at least: ${REQUIRED_MAPPED_FIELDS}")
    }
    detailsMapper = mapper
}

UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

    domainClass.withTransaction { status ->

        def user = domainClass.findByUsername(username)
        if (!user) throw new UsernameNotFoundException('User not found', username)

..。

因此，正如你从上面看到的，我认为最后一行可能是由于一些spring域名类/用户名的问题而被丢弃的地方？

如果问题与安装后登录Weceem相关(看起来并不是)，您需要确保已配置了Weceem Spring Security如何从用户域类映射到weceem和spring sec core运行所需的内部数据，请参阅：

http://grails.org/plugin/weceem-spring-security