Create a restful app with AngularJS/Grails (2)

Secure the backend REST API

In Spring application, Spring Security is usually used to secure the application. Grails has a builtin Spring Security based plugin to integrate Spring Security into Grails applications.

Install SpringSecurity core plugin

Open BuildConfig.groovy file, add spring-security-core plugin.

plugins {
    ...
    compile ":spring-security-core:2.0-RC2"
}

Run the following command in the project root folder to initialize the spring security plugin.

grails compile --non-interactive --refresh-dependencies

And use the built-in s2-quickstart script from this plugin to create the essential domain classes.

grails s2-quickstart Person Authority Requestmap

When it is done, the basic security configuration is added in Config.groovy.

grails.plugin.springsecurity.userLookup.userDomainClassName = 'com.hantsylabs.grails.example.security.Person'
grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'com.hantsylabs.grails.example.security.PersonAuthority'
grails.plugin.springsecurity.authority.className = 'com.hantsylabs.grails.example.security.Authority'
grails.plugin.springsecurity.requestMap.className = 'com.hantsylabs.grails.example.security.Requestmap'
grails.plugin.springsecurity.securityConfigType = 'Annotation'
grails.plugin.springsecurity.controllerAnnotations.staticRules = [
    '/':                              ['permitAll'],
    '/index':                         ['permitAll'],
    '/index.gsp':                     ['permitAll'],
    '/**/js/**':                      ['permitAll'],
    '/**/css/**':                     ['permitAll'],
    '/**/images/**':                  ['permitAll'],
    '/**/favicon.ico':                ['permitAll']
    ]

Configure securityConfigType

There are three securityConfigType supported by this spring security plugin.

• Annotation
• InterceptUrlMap
• Requestmap

By default, the Annotation type is configured.

grails.plugin.springsecurity.controllerAnnotations.staticRules is use for configuring the protection rule for the static resources. It is a map, the key is the url, the value is the configuration attribute which is a list and can accept the Spring security constants or Spring expression, eg. IS_AUTHENTICATED, isFullyAuthenticated(). If you have some experience of Spring security before, it is easy to understatnd.

Besides these, in your Java codes, you can use Grails or Spring Security specific @Secured annotation on methods in a Controller to apply the security restrict rules.

If you select InterceptUrlMap, all resources are protected by url intercepting only.

grails.plugin.springsecurity.securityConfigType = 'InterceptUrlMap'
grails.plugin.springsecurity.interceptUrlMap  = [
    '/':                              ['permitAll'],
    '/index':                         ['permitAll'],
    '/index.gsp':                     ['permitAll'],
    '/**/js/**':                      ['permitAll'],
    '/**/css/**':                     ['permitAll'],
    '/**/images/**':                  ['permitAll'],
    '/**/favicon.ico':                ['permitAll']
    ]

For Requestmap, it is easy to understand, it store the url intercepting mapping rules into database.

grails.plugin.springsecurity.securityConfigType = 'Requestmap'

There is a Requestmap class already generated for this project.

class Requestmap {

    String url
    String configAttribute
    HttpMethod httpMethod

    static mapping = {
        cache true
    }

    static constraints = {
        url blank: false, unique: 'httpMethod'
        configAttribute blank: false
        httpMethod nullable: true
    }
}

In the BootStrap.groovy class, you can add some codes to initialize the Requestmap.

def init = { servletContext ->
    ...
        for (String url in [
            '/', '/index', '/index.gsp', '/**/favicon.ico',
            '/**/js/**', '/**/css/**', '/**/images/**',
            '/login', '/login.*', '/login/*',
            '/logout', '/logout.*', '/logout/*']) {
         new Requestmap(url: url, configAttribute: 'permitAll').save()
      }

}

In this sample, InterceptUrlMap is used as example.

grails.plugin.springsecurity.securityConfigType = 'InterceptUrlMap'
grails.plugin.springsecurity.interceptUrlMap  = [
    '/':                              ['permitAll'],
    '/index':                         ['permitAll'],
    '/index.gsp':                     ['permitAll'],
    '/**/js/**':                      ['permitAll'],
    '/**/css/**':                     ['permitAll'],
    '/**/images/**':                  ['permitAll'],
    '/**/favicon.ico':                ['permitAll'],
    '/login/**':                    ['permitAll'],
    '/logout/**':                   ['permitAll'],
    '/**':                ['isFullyAuthenticated()']
    ]

The security plugin provides a LoginController and LogoutController for login and logout actions.

Run the project

Open BootStrap.groovy file, add some sample user data for test purpose.

def init = { servletContext ->

    def person =new Person(username:"test", password:"test123")
    person.save()

    def roleUser=new Authority(authority:"ROLE_USER")
    roleUser.save()

    new PersonAuthority(person:person, authority:roleUser).save()
}

In Eclipse IDE(Spring ToolSuite), select Run as-> Grails Command(run-app) in the project context menu,

Or in the command line, run the following command in the project root folder to run the this project.

grails run-app

Try to access the protected REST API resources, for example, http://localhost:8080/angluarjs-grails-sample/books.json. It will redirect to a login page. Login as test/test123, it will show the protected resources.

Sample codes

The code is hosted on https://github.com/hantsy/angularjs-grails-sample/.