Create a restful app with AngularJS/Grails(3)

Authentication and Authorization

Grails provides a series of built-in authentication solutions, such as Form, Basic, Digest etc. And there are several additional plugins which provides CAS, OAuth authentication, please search from the official Grails.org website.

For API centered applications, Basic is the simplest authentication.

Configure Basic authentication

By default, Form based authentication is enabled, it is easy to configure Basic authentication in Grails application.

Includes the following line in the Config.groovy file.

grails.plugin.springsecurity.useBasicAuth = true

Basic authentication includes a specific basicExceptionTranslationFilter, so the general-purpose exceptionTranslationFilter can be excluded.

grails.plugin.springsecurity.filterChain.chainMap = [
    '/api/**':'JOINED_FILTERS,-exceptionTranslationFilter',
    '/**':JOINED_FILTERS,-basicAuthenticationFilter,-basicExceptionTranslationFilter'
 ]

All resources matched /api/** will be protected and require authentication.

Try access the a protected resource, for example, http://localhost:8080/angularjs-grails-sample/api/books.json. There is a browser prompt popup for requiring username and password.

Stateless

By default, Grails will create session to store the user principle, it is useful for a web application. For a REST API, it is usually designated as stateless.

Spring security provides a stateless option in http element. In Grails, you could have to configure it yourself.

In the resources.groovy file, declare a SecurityContextRepository and SecurityContextPersistenceFilter bean.

statelessSecurityContextRepository(NullSecurityContextRepository) {}

statelessSecurityContextPersistenceFilter(SecurityContextPersistenceFilter, ref('statelessSecurityContextRepository')) {    }

The SecurityContextPersistenceFilter is responsible for session creation, and it delegates the real work to SecurityContextRepository bean. NullSecurityContextRepository is an implementation of SecurityContextRepository which does not create the user data in HttpSession, it is suitable for stateless case.

Apply it in Config.groovy.

grails.plugin.springsecurity.filterChain.chainMap = [
    '/api/**': 'statelessSecurityContextPersistenceFilter,logoutFilter,authenticationProcessingFilter,customBasicAuthenticationFilter,securityContextHolderAwareRequestFilter,rememberMeAuthenticationFilter,anonymousAuthenticationFilter,basicExceptionTranslationFilter,filterInvocationInterceptor',
 ]

In the above, all filters used for Basic authentication is listed one by one.

I also create a custom BasicAuthenticationEntryPoint.

public class CustomBasicAuthenticationEntryPoint extends
        BasicAuthenticationEntryPoint {

    private static Logger log = LoggerFactory
            .getLogger(CustomBasicAuthenticationEntryPoint.class);

    @Override
    public void commence(HttpServletRequest request,
            HttpServletResponse response, AuthenticationException authException)
            throws IOException, ServletException {
        // TODO Auto-generated method stub
        // super.commence(request, response, authException);
        log.debug("call @ commence...");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }

}

The purpose is simple, it maps the all authentication and authorization exception to 401 status. It simplifies the frontend AngluarJS processing work.

Configure this AuthenticationEntryPoint in resources.groovy.

customBasicAuthenticationEntryPoint(CustomBasicAuthenticationEntryPoint) {
    realmName = SpringSecurityUtils.securityConfig.basic.realmName // 'Grails Realm'
}

customBasicAuthenticationFilter(BasicAuthenticationFilter, ref('authenticationManager'), ref('customBasicAuthenticationEntryPoint')) {
    authenticationDetailsSource = ref('authenticationDetailsSource')
    rememberMeServices = ref('rememberMeServices')
    credentialsCharset = SpringSecurityUtils.securityConfig.basic.credentialsCharset // 'UTF-8'
}

basicAccessDeniedHandler(AccessDeniedHandlerImpl)

basicRequestCache(NullRequestCache)

basicExceptionTranslationFilter(ExceptionTranslationFilter, ref('customBasicAuthenticationEntryPoint'), ref('basicRequestCache')) {
    accessDeniedHandler = ref('basicAccessDeniedHandler')
    authenticationTrustResolver = ref('authenticationTrustResolver')
    throwableAnalyzer = ref('throwableAnalyzer')
}

Sample codes

The code is hosted on https://github.com/hantsy/angularjs-grails-sample/.