使用Spring Security Core插件在Grails应用程序上下文之外获取登录用户信息

Question

I am working on Grails Application with Spring Security Core PlugIn. I want to access the currently loggedIn user info with Spring Security Core outside the grails application context/controller scope. Can anyone please tell me that how can we get the information regarding currently loggedIn user info outside controller. I want to access this information in resources/services directory of grails application.

I tried this using: SecurityContextHolder.getContext().getAuthentication().principal.username; But I get Anonymous authentication with grails.anonymous.user

I tried another way too for this using httpSession:

 HttpSession session = RequestContextHolder.currentRequestAttributes().getSession()

 session.properties.each {
      println it;
 }

 SpringSecurityUtils.getSecurityContext(session).authentication.principal

But by this way too I couldn't get the Currently LoggedIn User Info. Because httpSession object didn't contain attribute 'SPRING_SECURITY_CONTEXT_KEY'.

Anybody tell me that how may I access this information in my desired directories ? Thanks for your time

Answer 1

Actually Spring Security uses HttpSession to store SecurityContext , so you can access it everywhere you can access HttpSession or HttpServletRequest :

SecurityContext securityContext = (SecurityContext)httpSession.getAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY);
def username = securityContext.getAuthentication().principal.username

SecurityContextHolder by default uses ThreadLocal variable to store context, so if you are retrieving information from another thread, it couldn't get any information and will create empty context. That's one of the possible reasons you've got anonymous authentication.

Answer 2

I think jasp explained a little bit. You can access the getAuthentication().principal.username from outside grails provided that you pass the javax.servlet.http.HttpServletRequest object that you obtained from controllers or filters as entry point.

For code in src/groovy and src/java:

Say you have a class named ExampleClazz.groovy in src/groovy

package com.test
import org.springframework.security.web.context.HttpSessionSecurityContextRepository

class ExampleClazz {

    def receiveRequest(javax.servlet.http.HttpServletRequest request){
        def userDetails = request.getSession().getAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY)

        if(userDetails){
            println userDetails.getAuthentication().principal.username
            return userDetails.getAuthentication().principal.username

        }else{
            return null
        }
    }

}  

To call this custom class, you register your bean in resource.groovy

// Place your Spring DSL code here
import com.test.ExampleClazz
beans = {
    sampleBean(ExampleClazz)
}

To call the ExampleClazz, you can inject it either in controller or filter. In Filter:

class ExampleFilters {
   def sampleBean
   def filters = {
        // your filters here

        someURIs(controller:'securepage',action:'index') {
            before = {
                println "before request"
                println sampleBean.receiveRequest(request) //<--the HttpServletRequest
            }
        }
   }
}

In Controller:

package com.test

class SomeController {
    def sampleBean
    def index() { 
        sampleBean.receiveRequest(request)//<--the HttpServletRequest

    }
}

The same concept goes for services. Just remember to pass the request object obtained from controllers as parameters in services.