My environment
- grails:2.3.5
- spring-security-core:2.0-RC2
- spring-security-ldap:2.0-RC2
- spring-security-rest:1.2.3
My simple API works fine with no namespace but starts returning a 403 when I add a namespace to my controller. I get back a 403 even when I pass a valid value for X-Auth-Token.
AuthorController.groovy
package bookstore import grails.plugin.springsecurity.annotation.Secured import grails.rest.RestfulController @Secured(['IS_AUTHENTICATED_FULLY']) class AuthorController extends RestfulController { static namespace = "testing" static responseFormats = ['json', 'xml'] AuthorController() { super(Author) } } UrlMappings.groovy
"/authors"(resources:"author", namespace:"testing") Logging
I turned up the logging on the security code and recorded the following with the namespace in place:
DEBUG context.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed DEBUG util.AntPathRequestMatcher - Request '/authors' matched by universal pattern '/**' DEBUG web.FilterChainProxy - /authors at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' DEBUG web.FilterChainProxy - /authors at position 2 of 10 in additional filter chain; firing Filter: 'RestLogoutFilter' DEBUG rest.RestLogoutFilter - Actual URI is /authors; endpoint URL is /logout DEBUG web.FilterChainProxy - /authors at position 3 of 10 in additional filter chain; firing Filter: 'MutableLogoutFilter' DEBUG web.FilterChainProxy - /authors at position 4 of 10 in additional filter chain; firing Filter: 'RestAuthenticationFilter' DEBUG rest.RestAuthenticationFilter - Actual URI is /authors; endpoint URL is /login DEBUG web.FilterChainProxy - /authors at position 5 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' DEBUG web.FilterChainProxy - /authors at position 6 of 10 in additional filter chain; firing Filter: 'GrailsRememberMeAuthenticationFilter' DEBUG web.FilterChainProxy - /authors at position 7 of 10 in additional filter chain; firing Filter: 'GrailsAnonymousAuthenticationFilter' DEBUG web.FilterChainProxy - /authors at position 8 of 10 in additional filter chain; firing Filter: 'RestTokenValidationFilter' DEBUG rest.RestTokenValidationFilter - Looking for a token value in the header 'X-Auth-Token' DEBUG rest.RestTokenValidationFilter - Token found: xxxxxxxxxxxxxxxxx DEBUG rest.RestTokenValidationFilter - Trying to authenticate the token DEBUG rest.RestAuthenticationProvider - Trying to validate token xxxxxxxxxxxxxxxxx DEBUG storage.MemcachedTokenStorageService - Searching in Memcached for UserDetails of token xxxxxxxxxxxxxxxxx DEBUG storage.MemcachedTokenStorageService - UserDetails found: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@: Dn: XXXXXXX; Username: username; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: DEBUG rest.RestAuthenticationProvider - Authentication result: com.odobo.grails.plugin.springsecurity.rest.RestAuthenticationToken@: Principal: N/A; Credentials: [PROTECTED]; Authenticated: false; Details: null; Not granted any authorities DEBUG rest.RestTokenValidationFilter - Token authenticated. Storing the authentication result in the security context DEBUG rest.RestTokenValidationFilter - Authentication result: com.odobo.grails.plugin.springsecurity.rest.RestAuthenticationToken@: Principal: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@: Dn: XXXXXXX; Username: username; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: DEBUG rendering.DefaultRestAuthenticationTokenJsonRenderer - Generated JSON: { "username": "username", "token": "xxxxxxxxxxxxxxxxx", "roles": [] } DEBUG rest.RestTokenValidationFilter - Actual URI is /authors; validate endpoint URL is /validate DEBUG rest.RestTokenValidationFilter - Continuing the filter chain DEBUG web.FilterChainProxy - /authors at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' DEBUG web.FilterChainProxy - /authors at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' DEBUG intercept.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /authors; Attributes: [_DENY_] DEBUG intercept.FilterSecurityInterceptor - Previously Authenticated: com.odobo.grails.plugin.springsecurity.rest.RestAuthenticationToken@: Principal: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@: Dn: XXXXXXX; Username: username; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: in zero or more steps. DEBUG access.ExceptionTranslationFilter - Access is denied (user is not anonymous); delegating to AccessDeniedHandler Message: Access is denied Line | Method ->> 47 | decide in grails.plugin.springsecurity.access.vote.AuthenticatedVetoableDecisionManager - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - | 88 | processFilterChain in com.odobo.grails.plugin.springsecurity.rest.RestTokenValidationFilter | 58 | doFilter . . . . . in '' | 53 | doFilter in grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter | 108 | doFilter . . . . . in com.odobo.grails.plugin.springsecurity.rest.RestAuthenticationFilter | 82 | doFilter in grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter | 66 | doFilter . . . . . in com.odobo.grails.plugin.springsecurity.rest.RestLogoutFilter | 82 | doFilter in com.brandseye.cors.CorsFilter | 1145 | runWorker . . . . in java.util.concurrent.ThreadPoolExecutor | 615 | run in java.util.concurrent.ThreadPoolExecutor$Worker ^ 744 | run . . . . . . . in java.lang.Thread DEBUG context.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed Then I looked at the logging with the namespace removed. Everything was identical until I got down to the FilterSecurityInterceptor:
DEBUG intercept.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /authors; Attributes: [IS_AUTHENTICATED_FULLY] DEBUG intercept.FilterSecurityInterceptor - Previously Authenticated: com.odobo.grails.plugin.springsecurity.rest.RestAuthenticationToken@: Principal: org.springframework.security.ldap.userdetails.LdapUserDetailsImpl@: Dn: XXXXXXX; Username: username; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; CredentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ; Credentials: [PROTECTED]; Authenticated: true; Details: null; Granted Authorities: in zero or more steps. DEBUG intercept.FilterSecurityInterceptor - Authorization successful DEBUG intercept.FilterSecurityInterceptor - RunAsManager did not change Authentication object DEBUG web.FilterChainProxy - /authors reached end of additional filter chain; proceeding with original chain DEBUG access.ExceptionTranslationFilter - Chain processed normally DEBUG context.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed Can someone please explain why I'm getting the DENY when my controlled has a namespace. I would like to experiment with versioning my web services and that requires a namespace. I've been looking at this all day and can't seem to make any headway.
Thanks in advance.