Grails安全性:如何预处理用户名(使其不区分大小写)？

Question

Spring Security的默认实现将用户名视为区分大小写,出于可用性原因,我需要使其不区分大小写(一个主要原因是具有移动设备的用户,其默认行为是大写输入文本的第一个字母).这是业务要求.

当控件传递给插件生成的LoginController时,为时已晚:Spring Security已经确定登录失败.使用调试器,我可以看到流程通过,org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter#attemptAuthentication但我不知道如何从Grails进行干预.事实上,插件使用了一个子类,org.codehaus.groovy.grails.plugins.springsecurity.RequestHolderAuthenticationFilter但这是在插件源中,而不是我的应用程序,所以我不知道在哪里进行干预.

任何指针都表示赞赏.谢谢.

环境:Grails 2.3,Spring Security Plugin 1.2.7.3

Answer 1

您可以使用自定义执行此操作UserDetailsService- 请参阅https://grails-plugins.github.io/grails-spring-security-core/v3/index.html#userDetailsS​​ervice

package com.yourcompany.yourapp

import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUser
import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUserDetailsService
import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils
import org.springframework.security.core.authority.GrantedAuthorityImpl
import org.springframework.security.core.userdetails.UserDetails
import org.springframework.security.core.userdetails.UsernameNotFoundException

class MyUserDetailsService implements GrailsUserDetailsService {

   static final List NO_ROLES = [new GrantedAuthorityImpl(SpringSecurityUtils.NO_ROLE)]

   UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
      User.withTransaction { status ->
         User user = User.findByUsernameIlike(username)
         if (!user) throw new UsernameNotFoundException('User not found', username)

         def authorities = user.authorities.collect { new GrantedAuthorityImpl(it.authority) }

         new GrailsUser(user.username, user.password, user.enabled, !user.accountExpired, !user.passwordExpired,
            !user.accountLocked, authorities ?: NO_ROLES, user.id)
      }
   }

   UserDetails loadUserByUsername(String username, boolean loadRoles) throws UsernameNotFoundException {
      loadUserByUsername username
   }
}

在grails-app/conf/spring/resources.groovy中注册以覆盖插件的实现:

beans = {
   userDetailsService(com.yourcompany.yourapp.MyUserDetailsService)
}