grails / grails-spring-security-rest

Grails plugin to implement token-based, RESTful authentication using Spring Security
http://alvarosanchez.github.io/grails-spring-security-rest/
Other
204 stars 114 forks source link

Fully qualified domain class name required to store Token using GORM #37

Closed dmahapatro closed 10 years ago

dmahapatro commented 10 years ago

Based on the documentation about GORM Token Storage, the domain class has to be mentioned as a fully qualified class instead of just the name of the class.

grails.plugin.springsecurity.rest.token.storage.gorm.tokenDomainClassName = 
    'AuthenticationToken'

The above config setting will fail to store the token because of this implementation in GromTokenStorageService.groovy

grailsApplication.getClassForName(tokenClassName) expects that the class name provided is a fully qualified name (should include package as well). In that case the config should look like (say for example package com.example.auth for domain class AuthenticationToken ):

grails.plugin.springsecurity.rest.token.storage.gorm.tokenDomainClassName = 
    'com.example.auth.AuthenticationToken'

If we want to provide the flexibility of providing only the class name and not the fully qualified package name in config then the logic in GormTokenStorageService has to change as below:

def dc = grailsApplication.domainClasses?.find { it.clazz.simpleName == tokenClassName }?.clazz

here and here

dmahapatro commented 10 years ago

@alvarosanchez , based on the decision to have a qualified class name or to use the suggested logic, I can submit the pull request. Thanks.

alvarosanchez commented 10 years ago

I agree with you. The line you mentioned was changed by 1dd5bb9 in pull request #24.

I believe the change is correct, but the documentation should reflect this. I will change it ASAP.

Thanks for the feedback.

dmahapatro commented 10 years ago

Thanks. Will it add value to the plugin if user has the flexibility to just specify the name of the domain class as we have right now in the documentation. This will need the above mentioned code change.

alvarosanchez commented 10 years ago

I don't see any benefit on not using a FQCN. Actually, Spring Security Core requieres FQCN's as well, so for consistency, it will be the same.

I've updated the documentation to reflect this.

Cheers.