spring security core grails not logging in

Question

Installed Spring Security Core as plugin then did quickstart

Here is my User domain class

package auth
class User {
   def springSecurityService
   String username
   String password
   boolean enabled
   boolean accountExpired
   boolean accountLocked
   boolean passwordExpired
   static mapping = {
          // password is a keyword in some sql dialects, so quote with backticks
          // password is stored as 44-char base64 hashed value
       password column: '`password`', length: 64
   }
   static constraints = {
       username blank: false, size: 1..50, unique: true
       password blank: false, size: 8..100
   }


   Set getAuthorities() {
      UserRole.findAllByUser(this).collect { it.role } as Set
   }

   def beforeInsert() {
     encodePassword()
   }

   def beforeUpdate() {
      if (isDirty('password')) {
        encodePassword()
      }
   }

   protected encodePassword() {
        password = springSecurityService.encodePassword(password, username)
   }
}

And my boostrap.groovy is

class BootStrap {

  def init = { servletContext ->

    auth.User james = new auth.User(username: 'test', enabled: true, password: 'password')
    james.save()
    if (james.hasErrors())
    {
        println("he has errors")
    }


    println("we made it! ")
}

   def destroy = {
   }
}

But when I go to login, it keeps saying "Sorry, we were not able to find a user with that username and password." Any thoughts?

Answer 1

This is because you are using the salt while encoding the password.

password = springSecurityService.encodePassword(password, username)

I have no idea of salting and hence can not guide you to much.

But if you encode your password without salting then your code works, just remove username when encoding the password, try this

password = springSecurityService.encodePassword(password)

Hope this helps.

Answer 2

If you create the user in BootStrap.groovy, try changing this:

def adminUser = User.findByUsername('admin') ?: new User(
    username: 'admin',
    password: springSecurityService.encodePassword('admin'),
    enabled: true).save(failOnError: true)

to this:

def adminUser = User.findByUsername('admin') ?: new User(
    username: 'admin',
    password: 'admin',
    enabled: true).save(failOnError: true)

The problem is that you are using the encoding password twice, once in the Domain and once in the constructor's parameters.

Answer 3

Can you validate that the user is actually bootstrapped into the database?

If so, I ran into a similar issue with Tomcat caching some data incorrectly.

Here is what I did:

1. Stopped Tomcat
2. Deleted all the files in Tomcat's Temp directory
3. Restarted Tomcat

After that, it worked fine.

Let me know if this helps.

Answer 4

Also, its been a while since I've built a Grails site from scratch, but I think I remember there being an issue with some online instructions. SpringSecurity might be encoding the password for you, so when you do it, it is getting double encoded.

Try removing the lines that encode the password.