Grails Security Without Database Implementation

Question

I am developing a web application with Grails 2.2.0 that performs all the actions through an implemented API that calls another server. This means that all things, even authentication and all related things, are done through the API and the corresponding server server.

Now, I wanted to use SpringSecurity or Apache Shiro Plugin for authentication and role management, etc., but what I came across all of them uses domain classes in connection with datbase, which is not what I intend to do. .. is it possible to use any of these plugins without connecting to the database without the need to configure them to a high degree? Or is there another plugin that I don’t know about that can bring the functionality that I need “no problem”?

I hope that the question itself is clear enough, otherwise, please feel free to ask me for a further / better explanation of my question :)

Answer 1

The Spring Security Core plugin uses domain classes and a database by default, but it’s easy to customize the user data source and roles using a special implementation of UserDetailsService . Here's a whole chapter in the docs .

I also talked about configuring the plugin and included an example of a specialized authentication provider. There is an example application and a link to a video about the conversation here .

Answer 2

The Apache Shiro plugin does not force you to use domain classes or a database. You may have Shiro Realm (put it in grails-app / realms) that delegates authentication and authorization to the server. It should be something like this:

 class BackendServerRealm { def authenticate(authToken) { // call backend authentication with credentials from authToken def user = backednService.authenticate(authToken.username, authToken.password) ... new SimpleAccount(user.username, user.password, "BackendServerRealm") } } 

Shiro just provides you with an authentication and authorization framework, but you can easily add your own implementation