grails spring security authentication token issue

Question

We have a grails/groovy application, we are using spring security. After calling our signin api and getting the authentication token, we call another api - details, we get the following error. We are calling these apis from an android app. We don't face this issue when we are testing the apis from postman.

2014-10-14 10:49:23,650 [qtp1955156240-20] DEBUG rest.RestAuthenticationFilter  - Actual URI is /api/details; endpoint URL is /api/login
2014-10-14 10:49:23,650 [qtp1955156240-20] DEBUG web.FilterChainProxy  - /api/v1/details at position 4 of 8 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2014-10-14 10:49:23,650 [qtp1955156240-20] DEBUG web.FilterChainProxy  - /api/v1/details at position 5 of 8 in additional filter chain; firing Filter: 'GrailsRememberMeAuthenticationFilter'
2014-10-14 10:49:23,650 [qtp1955156240-20] DEBUG web.FilterChainProxy  - /api/v1/details at position 6 of 8 in additional filter chain; firing Filter: 'RestTokenValidationFilter'
2014-10-14 10:49:23,650 [qtp1955156240-20] DEBUG rest.RestTokenValidationFilter  - Token found: 76ijdnfmjvvj8g56615dnj6kikj2rgnb
2014-10-14 10:49:23,650 [qtp1955156240-20] DEBUG rest.RestTokenValidationFilter  - Trying to authenticate the token
2014-10-14 10:49:23,651 [qtp1955156240-20] DEBUG rest.RestAuthenticationProvider  - Trying to validate token 76ijdnfmjvvj8g56615dnj6kikj2rgnb
2014-10-14 10:49:23,654 [qtp1955156240-20] DEBUG rest.RestTokenValidationFilter  - Authentication failed: User not found
2014-10-14 10:49:23,654 [qtp1955156240-20] DEBUG rest.RestAuthenticationFailureHandler  - Setting status code to 401

We are using spring security rest plugin.

I'd need more details to help you: what are you using to store tokens? Memcached or GORM? Have you tried to look by yourself the token 76ijdnfmjvvj8g56615dnj6kikj2rgnb in the store you use? — Álvaro Sánchez-Mariscal
We are using GORM and mongodb. We are able to make another api call just before this one. That executes successfully. We also see the same token in the logs when login happens. — Rupa Lahiri

Rupa Lahiri Rupa Lahiri · Accepted Answer · 2014-10-16T14:52:23

The username was been used by the spring security rest plugin as the key for the authentication token. We were modifying the username through an api call just after logging in. But not in the domain used by spring security rest plugin for authentication. Once we took care to update the username in the authentication domain used by spring security, the details api call is working fine.

grails spring security authentication token issue

1 Answers