ct@g authentication plugin for GRAILS > 7.x

Using spring-security.

application.yml

grails :
  plugin :
    springsecurity :
      password :
        algorithm : 'SHA-1'                # not used but needed if we use the new Sha1ToBCryptPasswordEncoder
        hash :
          iterations : 1
      userLookup :
        userDomainClassName : de.ctag.auth5.domain.User
        authorityJoinClassName : de.ctag.auth5.domain.UserRole
        usernamePropertyName : 'username'
        passwordPropertyName : 'password'
        authoritiesPropertyName : 'roles'
        enabledPropertyName : 'accountEnabled'
        accountExpiredPropertyName : 'accountExpired'
        accountLockedPropertyName : 'accountLocked'
        passwordExpiredPropertyName : 'credentialsExpired'
      authority :
        className : de.ctag.auth5.domain.Role
        nameField : 'name'

resources.groovy

/**
 * Our own implementation which can handle the 'accountEnabled' state of users
 * https://grails.github.io/grails-spring-security-core/5.1.1/#userDetailsService
 */
userDetailsService( CtagUserDetailsService ) {
	grailsApplication = ref( 'grailsApplication' )
}

userRoleLookupService( CtagUserRoleLookupService )

// Automatically encode passwords in the User domain tables
userPasswordEncoderListener( UserPasswordEncoderListener )

/**
 * Since legacy Apps are using SHA-1 encoding, but now we use BCrypt (from SHA-1),
 * we need this to support both formats.
 * There is also a GRAILS Listener, which takes care that passwords are encoded everytime a User.password is changed.
 * This Listener also detects the format, and handles correctly.
 */
// encode as BCrypt (from SHA1) but decode both by detecting the String at start
passwordEncoder( Sha1ToBCryptPasswordEncoder )

Sha1ToBCryptPasswordEncoder

This is a Spring security password encoder which can handle our old SHA-1 AND the new BCRYPT hashes.

• If the password is plain text, then first it generated the old SHA-1 hash, and then the new BCRYPT hash.
• If the password is SHA-1, then it generates the new BCRYPT hash.
• If the password already BCRYPT, then it does nothing.

Therefore, the new passwort gets a prefix: '{brypt}'

BCryptPasswordEncoder

The native spring security BCRYPT password encoder.

Password is encoded using brypt und stored like "$2a............."