2 Authentication Endpoint

If the authentication is successful, a token generator is used to generate a token, and a token storage implementation is used to store the token.

Finally, the JSON response sent back to the client is rendered by a restAuthenticationTokenJsonRenderer bean. The plugin offers you a default implementation that renders a response like this:

{
    "username": "john.doe",
    "token": "1a2b3c4d",
    "roles": [
        "ADMIN",
        "USER"
    ]
}

If you want your own, simply create a class implementing RestAuthenticationTokenJsonRenderer and wire it up in resources.groovy with name restAuthenticationTokenJsonRenderer.

The principal object stored in the security context, and passed to the JSON renderer, is coming from the configured authentication providers. In most cases, this will be a UserDetails object retrieved using the userDetailsService bean. If you want to render additional information in your JSON response, you have to:

1. Configure an alternative userDetailsService bean that retrieves the additional information you want, and put it in a principal object.
2. Configure an alternative restAuthenticationTokenJsonRenderer that reads that information from the restAuthenticationToken.principal object.

The following are the Config.groovy properties available:

Extracting credentials from the request

The plugin supports 2 ways of extracting the username and password: using request parameters, and using a JSON payload. For backwards compatibility, request parameters is the default option.

From request parameters

From a JSON request

To enable it:

The default implementation expects a request like this:

{
    "username": "john.doe",
    "password": "dontTellAnybody"
}

If your JSON request format is different, you can plug your own implementation by defining a class which extends AbstractJsonPayloadCredentialsExtractor. The default implementation looks like this:

@Log4j
class DefaultJsonPayloadCredentialsExtractor extends AbstractJsonPayloadCredentialsExtractor {
    UsernamePasswordAuthenticationToken extractCredentials(HttpServletRequest httpServletRequest) {
        def jsonBody = getJsonBody(httpServletRequest)
        log.debug "Extracted credentials from request params. Username: ${jsonBody.username}, password: ${jsonBody.password?.size()?'[PROTECTED]':'[MISSING]'}"
        new UsernamePasswordAuthenticationToken(jsonBody.username, jsonBody.password)
    }
}

Once you are done, register it in resources.groovy with the name credentialsExtractor.

2.1 Logout Endpoint

You can configure it in Config.groovy using this properties: