Grails 3 Spring Security LDAP Plugin and Tomcat 8

Question

I have an external YML file that contains some configuration for grails. In this file, one of the added configurations is for the grails spring security ldap plugin. My configuration looks as follows:

---
grails:
    plugin:
        springsecurity:
            ldap:
                context:
                    managerDn: 'uid=admin,ou=system'
                    managerPassword: 'secret'
                    server: 'ldap://localhost:10389'
                authorities:
                    groupSearchBase: 'ou=Groups,dc=c3cen,dc=com'
                    retreiveGroupRoles: true
                    retreiveDatabaseRoles: false
                    groupSearchFilter: 'member={0}'
                search:
                    base: 'ou=Users,dc=c3cen,dc=com'
            password:
                algoritham: 'SHA-256'
            interceptUrlMap: [
                {pattern: '/',               access: ['permitAll']},
                {pattern: '/error',          access: ['permitAll']},
                {pattern: '/index',          access: ['permitAll']},
                {pattern: '/index.gsp',      access: ['permitAll']},
                {pattern: '/shutdown',       access: ['permitAll']},
                {pattern: '/assets/**',      access: ['permitAll']},
                {pattern: '/**/js/**',       access: ['permitAll']},
                {pattern: '/**/css/**',      access: ['permitAll']},
                {pattern: '/**/images/**',   access: ['permitAll']},
                {pattern: '/**/favicon.ico', access: ['permitAll']},
                {pattern: '/login/**',       access: ['permitAll']},
                {pattern: '/logout/**',      access: ['permitAll']}
            ]
---

I also have some properties in the regular (provided by grails quick config) application yml file. This file only contains:

grails:
    plugin:
        springsecurity:
            securityConfigType: 'InterceptUrlMap'
            providerNames: ['ldapAuthProvider', 'anonymousAuthenticationProvider']

I am loading the external config in grails by overriding the setEnvironment method in Application.groovy class. It looks as follows:

    @Override
    void setEnvironment(Environment environment) {
        try {
            String configPath = System.getenv("local.config.location")
            def ymlConfig = new File(configPath)
            Resource resourceConfig = new FileSystemResource(ymlConfig)
            YamlPropertiesFactoryBean ypfb = new YamlPropertiesFactoryBean()
            ypfb.setResources(resourceConfig)
            ypfb.afterPropertiesSet()
            Properties properties = ypfb.getObject()
            environment.propertySources.addFirst(new PropertiesPropertySource("local.config.location", properties))
        } catch (Exception e) {
            log.error("unable to load the external configuration file", e)
        }
    }

When i issue the run-app command in grails, and deploy to my embedded tocat, everything works as expected. When I deploy manually to my local tomcat, I get the "The page isn't redirecting properly" error in firefox.

NOTE: I have confirmed with the log statements that the external file is being read by both tomcat servers. The odd part is that properties are being injected, but they are being overwritten by the default provided strings. For ex: dc=example is shown in the search.base , but in my code above, you can see clearly that it is in 'ou=Users,dc=c3cen,dc=com'. Note, both of these are present, but it is my guess that the default are overwriting the custom properties.

Is there something additional I need to change on my local (non-grails embeded) Tomcat server to allow the external properties to work? I have tried changing the location of the application.yml(external one) with no avail.

angryip angryip · Accepted Answer · 2016-03-16T17:17:22

The odd part that I noticed here is that the interceptUrlMap was the only invocation that failed to load from the external YML file. As that was the only provided method from the documentation at the time to be used for static routes, I took a different route. (used an external groovy config as opposed to a yml config)

Here is a list of things I did to make external configuration possible with the LDAP plugin. First, I ensured my application boot run class (Application.groovy) implemented EnvironmentAware. I overrode the setEnvironemnt method to be as follows:

@Override
void setEnvironment(Environment environment) {
    try {
        String configPath = System.getenv("local.config.location")
        def configFile = new File(configPath)
        def config = new ConfigSlurper().parse(configFile.toURI().toURL())
        environment.propertySources.addFirst(new MapPropertySource("externalGroovyConfig", config))
    } catch (Exception e) {
        log.error("unable to load the external configuration file", e)
    }
}

Next, I created a application.groovy file, and placed it in an alternate place (not in my project) My application.groovy file, now looks as follows:

grails.plugin.springsecurity.ldap.context.managerDn = 'uid=admin,ou=system'
grails.plugin.springsecurity.ldap.context.managerPassword = 'secret'
grails.plugin.springsecurity.ldap.context.server = 'ldap://localhost:10389/'
grails.plugin.springsecurity.ldap.authorities.groupSearchBase = 'ou=Groups,dc=c3cen,dc=com'
grails.plugin.springsecurity.ldap.authorities.retreiveGroupRoles = true
grails.plugin.springsecurity.ldap.authorities.retreiveDatabaseRoles = false
grails.plugin.springsecurity.ldap.authorities.groupSearchFilter = 'member={0}'
grails.plugin.springsecurity.ldap.search.base = 'ou=Users,dc=c3cen,dc=com'

grails.plugin.springsecurity.password.algoritham = 'SHA-256'

grails.plugin.springsecurity.controllerAnnotations.staticRules = [
    [pattern: '/',               access: ['permitAll']],
    [pattern: '/error',          access: ['permitAll']],
    [pattern: '/index',          access: ['permitAll']],
    [pattern: '/index.gsp',      access: ['permitAll']],
    [pattern: '/shutdown',       access: ['permitAll']],
    [pattern: '/assets/**',      access: ['permitAll']],
    [pattern: '/**/js/**',       access: ['permitAll']],
    [pattern: '/**/css/**',      access: ['permitAll']],
    [pattern: '/**/images/**',   access: ['permitAll']],
    [pattern: '/**/favicon.ico', access: ['permitAll']]
]

grails.plugin.springsecurity.filterChain.chainMap = [
    [pattern: '/assets/**',      filters: 'none'],
    [pattern: '/**/js/**',       filters: 'none'],
    [pattern: '/**/css/**',      filters: 'none'],
    [pattern: '/**/images/**',   filters: 'none'],
    [pattern: '/**/favicon.ico', filters: 'none'],
    [pattern: '/**',             filters: 'JOINED_FILTERS']
]

Grails 3 Spring Security LDAP Plugin and Tomcat 8

1 Answers