1

Using rememberme feature of grails security plugin based on Spring Security Core.

my config.groovy relevant contents are as follows:

// Added by the Spring Security Core plugin:
grails.plugins.springsecurity.userLookup.userDomainClassName = 'org.blah.user.User'
grails.plugins.springsecurity.userLookup.authorityJoinClassName = 'org.blah.user.UserRole'
grails.plugins.springsecurity.authority.className = 'org.blah.user.Role'

grails.plugins.springsecurity.successHandler.defaultTargetUrl = '/home'

grails.plugins.springsecurity.rememberMe.persistent = true
grails.plugins.springsecurity.rememberMe.persistentToken.domainClassName = 'org.blah.user.PersistentLogin'

grails.plugins.springsecurity.rememberMe.key = 'blah'
grails.plugins.springsecurity.rememberMe.alwaysRemember = true
// set cookie expiration to one year
grails.plugins.springsecurity.rememberMe.tokenValiditySeconds = 31536000l

Got a question about what happens when same user logs in from multiple clients/browsers. I'd like cookie to be remembered across all browsers, ie require one time login per browser, and then remember going forward... Is that the default behavior, if not, how to make that happen?

Additionally, i'd like to enforce single concurrent login, ie log in from multiple places is allowed, but restricted to only one active session per user.

1
  • FYI, cookies are per-browser. Sharing them would be a massive security hole.
    – cdeszaq
    Aug 27, 2012 at 13:42

2 Answers 2

1

the plugin doesn't do this out of the box. At a high level you'd probably need to do the following:

1) Write your own Remember Me Authentication Filter e.g. http://www.to-string.com/2012/07/11/springsecurity-capturing-rememberme-success-event/

2) You'd then have to change your own Persistent Login token to capture some other piece of data e.g. IP address or Browser and save both of those in the persistent Login Token

3) Write your own remember Me services which extends TokenBasedRememberMeServices. You'll need to override 2 methods processAutoLoginCookie and makeTokenSignature minimally to add in your own logic for checking the format of the cookie

4) wire it all together in resources.groovy with...

    userDetailsService(com.yourclass.UserDetailsService)

    customRememberMeServices(com.yourclass.CustomRememberMeServices) {
        userDetailsService = ref("userDetailsService")
        key = "key"
    }

    rememberMeAuthenticationFilter(com.yourclass.CustomRememberMeAuthenticationFilter) {
        rememberMeServices = ref('customRememberMeServices')
        authenticationManager = ref("authenticationManager")
    }
0

What you are looking for is per-computer authentication, regardless of browser used, and this is simply not possible to do securely using only browsers and only logging in one time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.