The Grails Spring Security plugin is a wonderful thing and certainly worthy of more time spent on it than in this quick post. It saves days, if not weeks of work, plumbing in the standard security model of most websites. Notwithstanding its obvious benefits, I have noticed that many people struggle with some features of it, especially when retro-fitting it to an existing database schema and I can only assume it’s because the best examples of performing common tasks are only seen when generating the classes from scratch, using the generate-registration and generate-manager scripts.

One problematic case is programmatically logging in a user, for example after registration, and the example below showing how to do it is taken straight from the auto-generated code of the Spring Security generate-registration script which creates a RegisterController:

class RegisterController {
    def daoAuthenticationProvider
...
    private def loginUserFromRequestCredentials() {
        def auth = new AuthToken(params.username, params.passwd)
        def authtoken = daoAuthenticationProvider.authenticate(auth)
        SecurityContextHolder.context.authentication = authtoken
    }

In that example the request parameters from the controller were used to create an AuthToken, but that means both a username and password are required. To dynamically log in a user without a plain-text password is not so obvious, but the following code does just that, authorising every role for a particular username:

 
import org.springframework.security.context.SecurityContextHolder
import org.springframework.security.providers.UsernamePasswordAuthenticationToken
import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUserImpl
import org.springframework.security.GrantedAuthority
import org.springframework.security.GrantedAuthorityImpl
...
    private def loginUserFromUsername(username) {
        def user = User.findByUsername(username)
        GrantedAuthority[] auths = user.authorities.collect {
            new GrantedAuthorityImpl(it.authority)
        }
        def grailsUser = new GrailsUserImpl(
                user.username,
                "",
                true,
                true,
                true,
                true,
                auths,
                user)

        def authToken =  new UsernamePasswordAuthenticationToken(
                grailsUser, '', auths)
        SecurityContextHolder.context.authentication = authToken
    }

In this example the granted authorities (roles) are assembled by hand and the authentication is sidestepped by directly creating a UsernamePasswordAuthenticationToken to add to the SecurityContextHolder. Note that it’s necessary to wrap the domain object in a GrailsUserImpl so that it has the correct methods on it for the authentication framework (like those used by the authenticateService).

Bear in mind that this second method completely sidesteps the security in your app, so use it with extreme care or not at all!