grails - 使Grails Spring Security REST与自定义身份验证提供程序一起使用时出现问题

Question

我有一个与自定义身份验证提供程序一起使用的项目，该项目允许用户使用用户名，密码和组织编号登录。我创建了自己的AuthFilter，AuthProvider和UserPassOrgAuthToken。

这就像从Web(Grails Spring Security Core)登录 super 按钮一样。

现在，我需要在/ rest / **下为我的REST API添加安全性，并进行相同类型的登录用户+ pass + org来获得JWT。

我安装了插件，并设置了一些配置(https://github.com/ppazos/cabolabs-ehrserver/commit/1524ac56971f6e4a613ba1b6778d6fd3f6e368c0)，但是当我尝试POST到/ rest / login时，我得到了401 Unauthorized。

另外，我在提供程序和过滤器上添加了一些printlns，似乎根本没有执行(请参见上面的提交链接)。

请，如果您看到任何错误的配置，或者对如何进行此工作有任何指示，我们非常欢迎所有评论!

编辑:这是日志的输出

2015-12-10 12:24:00,996 [http-bio-8090-exec-10] DEBUG matcher.AntPathRequestMatcher  - Checking match of request : '/rest/login'; against '/rest/**'
2015-12-10 12:24:00,996 [http-bio-8090-exec-10] DEBUG web.FilterChainProxy  - /rest/login at position 1 of 8 in additional filter chain; firing Filter: 'AuthFilter'
2015-12-10 12:24:00,996 [http-bio-8090-exec-10] DEBUG web.FilterChainProxy  - /rest/login at position 2 of 8 in additional filter chain; firing Filter: 'MutableLogoutFilter'
2015-12-10 12:24:00,996 [http-bio-8090-exec-10] DEBUG web.FilterChainProxy  - /rest/login at position 3 of 8 in additional filter chain; firing Filter: 'RestAuthenticationFilter'
2015-12-10 12:24:01,036 [http-bio-8090-exec-10] DEBUG rest.RestAuthenticationFilter  - Actual URI is /rest/login; endpoint URL is /rest/login
2015-12-10 12:24:01,036 [http-bio-8090-exec-10] DEBUG rest.RestAuthenticationFilter  - Applying authentication filter to this request
2015-12-10 12:24:01,277 [http-bio-8090-exec-10] DEBUG credentials.DefaultJsonPayloadCredentialsExtractor  - Extracted credentials from JSON payload. Username: admin, password: [PROTECTED]
2015-12-10 12:24:01,297 [http-bio-8090-exec-10] DEBUG rest.RestAuthenticationFilter  - Trying to authenticate the request
2015-12-10 12:24:01,437 [http-bio-8090-exec-10] DEBUG rest.RestAuthenticationFilter  - Authentication failed: No AuthenticationProvider found for org.springframework.security.authentication. UsernamePasswordAuthenticationToken
2015-12-10 12:24:01,437 [http-bio-8090-exec-10] DEBUG bearer.BearerTokenReader  - Looking for bearer token in Authorization header, query string or Form-Encoded body parameter
2015-12-10 12:24:01,457 [http-bio-8090-exec-10] DEBUG bearer.BearerTokenReader  - No token found
2015-12-10 12:24:01,467 [http-bio-8090-exec-10] DEBUG bearer.BearerTokenAuthenticationFailureHandler  - Sending status code 401 and header WWW-Authenticate: Bearer
2015-12-10 12:24:01,467 [http-bio-8090-exec-10] DEBUG rest.RestAuthenticationFilter  - Not authenticated. Rest authentication token not generated

Answer 1

您应该将/rest/login权限设置为permitAll

grails.plugin.springsecurity.controllerAnnotations.staticRules = [
  "/rest/login": ["permitAll"]
]

因为从spring-security-core 2.0版开始，默认情况下所有url protected