Question

I have a grails site (grails 2.0 with spring security 1.2.6) login that’s supposed to redirect depending on what parameters are passed in through the URL.

For example, if you went to '/' you would go to the standard 'login/auth' but if you went to '/?org=abccorp' you would be redirected to 'landing/index'. Once you log in successfully you’ll be taken to different parts of the site based on the params passed in through the url and security role.

So far I have been able to get everything working in a normal scenario where someone logs in successfully. My problem comes from if someone fails the login, spring security redirects to the default 'login/authfail' action with no way of finding the original url or parameters.

Supposedly there’s a way to get these things but everything I’ve found has either been deprecated, moved or is simply not there.

Is there a way to get what params were originally passed in? Can I save them off somewhere between calls or something like that?

Answer 1

The authenticationFailureHandler bean uses a org.springframework.security.web.RedirectStrategy instance to do the redirect when login fails. This is by default a org.springframework.security.web.DefaultRedirectStrategy instance and is registered as the redirectStrategy bean. So you could replace the redirectStrategy bean for the authenticationFailureHandler bean with your own. It doesn’t look like it’d be practical to replace the whole redirectStrategy bean since you don’t have access to the Authentication so you wouldn’t know whether it was a failure or success redirect.

To avoid redefining the whole authenticationFailureHandler bean, I’d just change the bean in BootStrap.groovy. It’d be something like this (I haven’t tested this so it might be off a bit)

import com.foo.bar.MyRedirectStrategy

class BootStrap {

   def authenticationFailureHandler

   def init = { servletContext ->
      authenticationFailureHandler.redirectStrategy = new MyRedirectStrategy()
   }
}

where MyRedirectStrategy is a custom subclass of DefaultRedirectStrategy (in src/groovy or src/java) that uses the request url to determine the redirect url.