CODEWITHSUNDEEP
grailsspring-security
blackuprise
blackuprise

Reputation: 450

Updating spring security user's password field?

I have a problem with updating password field for User class, I'm using SpringSecurity plugin in grails, saw that it should be done like this but is not working...

user.password = springSecurityService.encodePassword(
                params.password, userInstance.username)

tried also 

user.password = springSecurityService.encodePassword(
                params.password)

any ideas?

Upvotes: 2

Views: 2422

Answers (2)

Burt Beckwith
Burt Beckwith

Reputation: 75671

If you're using a newer version of the plugin (1.2.7 or higher) then you don't want to encode the password explicitly like you're doing, since the generated code in the User class does it for you. Only call springSecurityService.encodePassword if your domain class doesn't, otherwise you'll double-encode and not be able to login.

If you do encode the password yourself, the first version you've shown is using the username as the salt, and the second has no salt. Salting passwords is a good idea but not required - you can read about it in the documentation, section 12.2 - http://grails-plugins.github.com/grails-spring-security-core/docs/manual/

Upvotes: 2

chrislovecnm
chrislovecnm

Reputation: 2621

You might want to take a look at how the author of Grails Spring Sec plugin is doing it in his ui plugin

https://github.com/grails-plugins/grails-spring-security-ui/blob/master/grails-app/controllers/grails/plugins/springsecurity/ui/UserController.groovy

Upvotes: 0

Related Questions