grails spring security ui login weird redirect sometimes

3
votes

Good day all,

I am working on an application in Grails where I am attempting to use spring security core and ui. Specifically I have used s2ui-override to override user, role, auth and layout.

Generally it seems to be working. I have encountered a very odd problem now though and I can't seem to fix it.

When I click on the login link on my home page, I am sent to the s2ui login page as expected. Once I fill in known credentials and click the login button, I receive a "Sorry you're not authorized to view this page" message; meanwhile the url displayed in the Firefox address panel is

http://localhost:8080/galaxy/plugins/jquery-ui-1.10.3/jquery-ui/themes/ui-lightness/jquery-ui-1.10.3.custom.css

I had this behaviour earlier but (I thought I had) corrected it by adding the following two lines to grails.plugin.springsecurity.controllerAnnotations.staticRules in my Config.groovy

'/login/**':                      ['permitAll'],
'/logout/**':                     ['permitAll']

The weird part of this is that if I click back in the browser, I return to the s2ui login panel (fields empty); if I fill them in again (same user) and click the login button, this time I am redirected to my home page as expected.

This behaviour is consistent as far as I can see, that is, it works the second time every time.

1
grailsloginspring-security
Can you create a unit test that recreates the problem? - chrislovecnm
Thanks for that suggestion. I thought that I might first follow the suggestion below, which seems to have solved the problem. - MonetsChemist

1 Answers

5
votes

I'm fairly certain this is because the asset being redirected to is being blocked by the Spring Security plugin prompting the login & returning to the requesting asset.

Double check that, grails.plugin.springsecurity.controllerAnnotations.staticRules, contains a proper entry to match the asset being delivered/requested.

Config.groovy:
grails.plugin.springsecurity.controllerAnnotations.staticRules =[ '/plugins/**':['permitAll']

The root cause of this is probably due to the Spring Security UI plugin not (yet?) utilizing the Asset Pipeline which is now default.