Question

I use grails spring security with a custom auth method for facebook authentication:

def auth() {
    ...
}

When I check the cookie in my browser I can see that the cookie lifetime is finished when the browser session is closed. The persistent rememberMe cookie is set only if I use the default login/auth action from the plugin.

What do I have to change such that the user which is loggedin with my custom auth method is not logged out between sessions?

For reauthentication I use:

def success() {

    // get facebook user data

    springSecurityService.reauthenticate username

    if(springSecurityService.loggedIn) {
            // do something

    }
}

How do I set the rememberMe cookie?

Answer 1

Idea: let the spring security remember me service know it should consider the successful login.

1. In your facebook success action, upon successful authentication, do the following:

   //wire remember me services
   def rememberMeServices
   
   //... in your action:
   springSecurityService.reauthenticate username
   
   def authentication = SecurityContextHolder.context.authentication
   rememberMeServices.loginSuccess(request, response, authentication)
   

2. in your Config.groovy, add the following

   grails.plugins.springsecurity.rememberMe.alwaysRemember = true