Although there is no current default mechanism for authentication as it is possible to implement authentication in literally thousands of different ways. It is however, trivial to implement a simple authentication mechanism using either
interceptors or
filters.
Filters allow you to apply authentication across all controllers or across a URI space. For example you can create a new set of filters in a class called
grails-app/conf/SecurityFilters.groovy
:
class SecurityFilters {
def filters = {
loginCheck(controller:'*', action:'*') {
before = {
if(!session.user && actionName != "login") {
redirect(controller:"user",action:"login")
return false
}
} }
}
}
Here the
loginCheck
filter will intercept execution
before an action executed and if their is no user in the session and the action being executed is not the
login
action then redirect to the
login
action.
The
login
action itself is trivial too:
def login = {
if(request.get) render(view:"login")
else {
def u = User.findByLogin(params.login)
if(u) {
if(u.password == params.password) {
session.user = u
redirect(action:"home")
}
else {
render(view:"login", model:[message:"Password incorrect"])
}
}
else {
render(view:"login", model:[message:"User not found"])
}
}
}