apache / apache/grails-core

JWT Refresh Token does not work with grails-spring-security-ldap

Open
#15,929 6 comments 0 reactions 0 assignees View on GitHub
relates-to:spring-security
Dominant language
Groovy
Stars
2.9k
Forks
975
Avg merge
1d 22h
Merged PRs (30d)
92

Description

grails 3.3.10

application.yml
grails:
plugin:
springsecurity:
ldap:
context:
managerDn: 'uid=admin,ou=system'
managerPassword: 'secret'
server: 'ldap://myldap'
authorities:
groupSearchBase: 'ou=Groups,ou=TPS,dc=example,dc=com'
search:
base: 'ou=Users,ou=TPS,dc=example,dc=com'
rest:
token:
storage:
jwt:
secret: 'myjwttokensecret'

build.gradle
compile 'org.grails.plugins:spring-security-core:3.2.3'
compile "org.grails.plugins:spring-security-rest:2.0.0.RC1"
compile 'org.grails.plugins:spring-security-ldap:3.0.2'

I am using JWT Token generation from org.grails.plugins:spring-security-rest after authenticating with Apache Directory Server.

I use the login endpoint "/api/login" to get a JWT token which works.
I use the validate endpoint "/api/validate" to validate the JWT Token which also works.

The problem is the "/oauth/access_token" endpoint always returns 403 because an exception is thrown.

Here is what I believe to be the issues:

line 55 in grails.plugin.springsecurity.rest.token.storage.jwt.JwtTokenStorageService is
"UserDetails principal = userDetailsService.loadUserByUsername(jwt.JWTClaimsSet.subject)"

The userDetailsService that is injected is an instance of GormUserDetailsManager when I would have expected to be an instance of GrailsLdapUserDetailsManager or some other LDAP implementation.

Is this something this Ldap Plugin should be injecting?

Contributor guide

Open the contributing guide

Research direction

Start by tracing JwtTokenStorageService at line 55 and the /oauth/access_token flow, then compare the injected GormUserDetailsManager with the LDAP-related GrailsLdapUserDetailsManager. Reproduce the 403 using the supplied application.yml and build.gradle versions; done means refresh-token requests work with the LDAP-authenticated user.

Written by the indexing model from the issue text.

Assessment

Tech stack
groovy
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.