Grails spring Security add authentication method

Question

I have an application that requires the users to choose between 2 different authentication methods. One being username/password authentication and the other being username/password/one-time-password.

i have created the additional authentication provider and it works well when overriding the daoAuthenticationProvider provider in my resources.groovy as done in http://burtbeckwith.com/blog/?p=1090

however now when i need my authentication method to live side by side with the standard daoAuthenticationProvider i am a bit stuck.

I know i have my custom authentication provider and a custom filter registered in resources.groovy. The question is how do i make a url("redirect /my_auth to the filter") be intercepted by my custom filter?

Asynkronos Asynkronos · Accepted Answer · 2012-07-04T20:29:17

Instead of registering the filters in resources.groovy, you can do this using filterChain configurations in Config.groovy. Declare all the filters spring security will be using in filterchain.filterNames, including both the standard filters you want, as well as your custom ones:

grails.plugins.springsecurity.filterChain.filterNames = [
   'securityContextPersistenceFilter', 'logoutFilter',
   'authenticationProcessingFilter', 'firstCustomFilter','secondCustomFilter',
   'rememberMeAuthenticationFilter', 'anonymousAuthenticationFilter',
   'exceptionTranslationFilter', 'filterInvocationInterceptor'
]

Then map your custom filters to specific URLs - one way to do this using exclusions is as follows:

grails.plugins.springsecurity.filterChain.chainMap = [
    '/customUrlOne/**': 'JOINED_FILTERS,-secondCustomFilter',
    '/customUrlTwo/**': 'JOINED_FILTERS,-firstCustomFilter',
    '/**':  'JOINED_FILTERS,-firstCustomFilter,-secondCustomFilter'
]

JOINED_FILTERS is the set of all filters you've declared in the first map. Under "/**", all filters except your custom filters which have been excluded will be active. Similarly, under the custom URLs, all filters, minus the excluded custom filter meant for the other URL will be active. This will ensure that traffic going to customUrlOne will be intercepted by firstCustomFilter, and traffic going to customUrlTwo will be intercepted by secondCustomFilter.

Grails spring Security add authentication method

1 Answers