title: grails spring security rest /api/login 401 Unauthorized
body: <p>I have configured a Grails(2.3.7) app using <strong>spring-security-core:2.0.0</strong> + <strong>spring-security-rest:1.4.1</strong> plugins in order to have two auth types, a statefull auth for web and one for mobile using tokens(stateless). All good, basic http auth is working well. Trying to get authenticated using POSTMAN rest client to <strong><a href="http://localhost:8080/api/login" rel="nofollow noreferrer">http://localhost:8080/api/login</a></strong> having username and password in the request payload i get <strong>401 Unauthorized</strong> , I'm not able to understand why?What is missing from below configuration? Any help is highly appreciated.
  I tried as well with <strong>spring-security-rest:1.5.0</strong> but i got the same result, 401.</p>
  
  <p><strong>BuildConfig.groovy</strong></p>
  
  <pre><code> plugins {
     ...
      compile ":spring-security-core:2.0.0"
      compile ":spring-security-rest:1.4.1", {
          excludes ('spring-security-core')
      }
  ...
  }
  </code></pre>
  
  <p><strong>Config.groovy</strong></p>
  
  <pre><code>   / Added by the Spring Security Core plugin:
  grails.plugin.springsecurity.successHandler.defaultTargetUrl = '/general'
  grails.plugin.springsecurity.userLookup.userDomainClassName = 'org.sali.Users.SecUser'
  grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'org.sali.Users.SecUserSecRole'
  grails.plugin.springsecurity.authority.className = 'org.sali.Users.SecRole'
  grails.plugin.springsecurity.securityConfigType = "Annotation"
  
  grails.plugin.springsecurity.roleHierarchy = '''
      ROLE_ADMIN &gt; ROLE_OPERATOR
  '''
  grails.plugin.springsecurity.useSwitchUserFilter = true
  
  grails.plugin.springsecurity.controllerAnnotations.staticRules = [
          '/j_spring_security_switch_user': ['permitAll'],
          '/api/**': ['permitAll']
  ]
  
  
  grails.plugin.springsecurity.filterChain.chainMap = [
          //'/api/**': 'JOINED_FILTERS,-anonymousAuthenticationFilter,-exceptionTranslationFilter,-authenticationProcessingFilter,-securityContextPersistenceFilter',// Stateless chain
          '/api/**': 'JOINED_FILTERS,-exceptionTranslationFilter,-authenticationProcessingFilter,-securityContextPersistenceFilter,-rememberMeAuthenticationFilter',
          '/**': 'JOINED_FILTERS,-restTokenValidationFilter,-restExceptionTranslationFilter',                                          // Traditional chain
  ]
  //gorm
  grails.plugin.springsecurity.rest.token.storage.useGorm = true
  grails.plugin.springsecurity.rest.token.storage.gorm.tokenDomainClassName = 'org.sali.Rest.AuthenticationToken'
  grails.plugin.springsecurity.rest.token.storage.gorm.tokenValuePropertyName = 'token'
  grails.plugin.springsecurity.rest.token.storage.gorm.usernamePropertyName = 'username'
  
  
  //login
  grails.plugin.springsecurity.rest.login.active=true
  grails.plugin.springsecurity.rest.login.useJsonCredentials = true
  grails.plugin.springsecurity.rest.login.failureStatusCode = 401
  grails.plugin.springsecurity.rest.login.usernamePropertyName = 'username'
  grails.plugin.springsecurity.rest.login.passwordPropertyName='password'
  grails.plugin.springsecurity.rest.login.endpointUrl='/api/login'
  grails.plugin.springsecurity.rest.login.useRequestParamsCredentials = false
  
  //logout
  grails.plugin.springsecurity.rest.logout.endpointUrl='/api/logout'
  
  //token generation
  grails.plugin.springsecurity.rest.token.generation.useUUID=false
  grails.plugin.springsecurity.rest.token.generation.useSecureRandom=true
  
  //token rendering
  grails.plugin.springsecurity.rest.token.rendering.usernamePropertyName='username'
  grails.plugin.springsecurity.rest.token.rendering.authoritiesPropertyName='roles'
  grails.plugin.springsecurity.rest.token.rendering.tokenPropertyName='token'
  
  //token validate
  grails.plugin.springsecurity.rest.token.validation.useBearerToken = true
  
  //if disable 'Bearer', you can configure a custom header.
  //grails.plugin.springsecurity.rest.token.validation.useBearerToken = false
  //grails.plugin.springsecurity.rest.token.rendering.tokenPropertyName   access_token
  //grails.plugin.springsecurity.rest.token.validation.headerName = 'x-auth-token'
  grails.plugin.springsecurity.rest.token.validation.active=true
  grails.plugin.springsecurity.rest.token.validation.endpointUrl='/api/validate'
  
  
  
  //grails.plugin.springsecurity.rest.token.validation.headerName = 'X-Auth-Token'
  //grails.plugin.springsecurity.rest.token.validation.useBearerToken = false
  
  //grails.plugin.springsecurity.password.algorithm = 'SHA-256'
  //grails.plugin.springsecurity.password.hash.iterations = 1
  
  //cors
  
  cors.enabled=true
  cors.url.pattern = '/api/*'
  cors.headers=[
          'Access-Control-Allow-Origin': '*',
          'Access-Control-Allow-Credentials': true,
          'Access-Control-Allow-Headers': 'origin, authorization, accept, content-type, x-requested-with,X-Auth-Token',
          'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS',
          'Access-Control-Max-Age': 3600
  ]
  </code></pre>
  
  <p><strong>UrlMappings.groovy</strong></p>
  
  <pre><code>class UrlMappings {
  
      static mappings = {
          "/$controller/$action?/$id?"{
              constraints {
                  // apply constraints here
              }
          }
  
          "/"(controller: "login")
          "404"(view:'/error')
          "405"(view:'/error')
          "500"(view:'/error')
          "/login/$action?"(controller: "login")
          "/logout/$action?"(controller: "logout")
  
      }
  }
  </code></pre>
  
  <p>Any ideas are very welcomed. Thx</p>