ianroberts commented on issue #15877:
URL: https://github.com/apache/grails-core/issues/15877#issuecomment-6465465607
I have worked around this in my own app in a slightly hacky way by replacing
two of the default beans with my own subclasses - the
`AuthenticationEntryPoint` with a version that traps
`InsufficientAuthenticationException` (the exception that signals that we have
"remembered" authentication but need full authentication) and redirects to
`/login/full` instead of `/login/auth`, and the
`RememberMeAuthenticationFilter` with a version that skips the remembered check
when rendering the `/login/full` page.
This works, the only side effect is that the GSP for the `/login/full` form
always sees the user as unauthenticated, so any
`<sec:ifLoggedIn>`/`<sec:ifNotLoggedIn>`/`<sec:ifAnyGranted>` etc. tags in the
layout will render the non-authenticated content rather than showing the user's
remembered login details.
**RememberMeAwareAuthenticationEntryPoint.groovy**
```groovy
@CompileStatic
class RememberMeAwareAuthenticationEntryPoint extends
AjaxAwareAuthenticationEntryPoint {
/**
* @param loginFormUrl URL where the login page can be found. Should
either be relative to the web-app context path
* (include a leading {@code /}) or an absolute URL.
*/
RememberMeAwareAuthenticationEntryPoint(String loginFormUrl) {
super(loginFormUrl)
}
@Override
protected String determineUrlToUseForThisRequest(HttpServletRequest req,
HttpServletResponse res, AuthenticationException e) {
if(e instanceof InsufficientAuthenticationException) {
// we have a remembered token but we require full authentication
return "/login/full"
}
return super.determineUrlToUseForThisRequest(req, res, e)
}
}
```
**RememberMeAuthenticationFilterSkipLogin.groovy**
```groovy
@CompileStatic
class RememberMeAuthenticationFilterSkipLogin extends
GrailsRememberMeAuthenticationFilter {
RequestMatcher requestMatcher
RememberMeAuthenticationFilterSkipLogin(
AuthenticationManager authenticationManager,
RememberMeServices rememberMeServices,
RequestCache requestCache) {
super(authenticationManager, rememberMeServices, requestCache)
requestMatcher = new AntPathRequestMatcher("/login/full")
}
@Override
void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
if(requestMatcher.matches((HttpServletRequest) request)) {
// bypass the remembered authentication when rendering the full login
form
chain.doFilter(request, response)
} else {
super.doFilter(request, response, chain)
}
}
}
```
**application.yml**
```yaml
grails:
plugin:
springsecurity:
authenticationEntryPointBeanClass:
"my.pkg.RememberMeAwareAuthenticationEntryPoint"
rememberMeAuthenticationFilterBeanClass:
"my.pkg.RememberMeAuthenticationFilterSkipLogin"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
