MEAP v13 ch11 Update for Spring Security Integration

[danhyun]

In Grails 2.3.4, the BuildConfig contains a commented out declaration for spring security.

compile ':spring-security-core:2.0-RC2'

It also now generates 3 classes, User Role and UserRole from the s2-quickstart command.

As documented here http://grails-plugins.github.io/grails-spring-security-core/docs/manual/guide/domainClasses.html#personAuthorityClass : The UserRole class is to compensate for hibernate.

It also seems that the new prefix for properties is grails.plugin vs grails.plugins

vs

Section 11.2

With the new plugin, this code will no longer work:

This is because the new LoginController checks either for a POST http method or an overriding property. I'm guessing they switched to this form submission for more security?

I guess we could also modify the controller code.

@Secured('permitAll')
class LogoutController {

/**
 * Index action. Redirects to the Spring security logout uri.
 */
def index() {

    if (!request.post && SpringSecurityUtils.getSecurityConfig().logout.postOnly) {
        response.sendError HttpServletResponse.SC_METHOD_NOT_ALLOWED // 405
        return
    }

    // TODO put any pre-logout code here
    redirect uri: SpringSecurityUtils.securityConfig.logout.filterProcessesUrl // '/j_spring_security_logout'
}
}

[pledbrook]

Thanks for the report. I'm still not sure whether to use version 2 of the plugin for the book since a final version hasn't been released yet, but I think it makes sense.

[pledbrook]

The author of the plugin expects to have a final release out some time in February, in plenty of time for the publication of the book. So I will update to version 2 of the plugin.

[danhyun]

That's great news :+1:

[danhyun]

The author of the Twitter integration has a fix for how to get past the s2-init-twitter command failing:

https://github.com/splix/grails-spring-security-twitter/issues/23

[splix]

Hi guys, just found this project. Maybe I can help you with examples for my plugins (twitter and facebook auth)? or something else?