## 11.3 Authentication

Although there is no current default mechanism for authentication as it is possible to implement authentication in literally thousands of different ways. It is however, trivial to implement a simple authentication mechanism using either interceptors or filters.

Filters allow you to apply authentication across all controllers or across a URI space. For example you can create a new set of filters in a class called `grails-app/conf/SecurityFilters.groovy`:

    class SecurityFilters {
       def filters = {
           loginCheck(controller:'*', action:'*') {
               before = {
                  if(!session.user && actionName != "login") {
                      redirect(controller:"user",action:"login")
                      return false
    	           }
               }       }
       }
    }

Here the `loginCheck` filter will intercept execution before an action executed and if their is no user in the session and the action being executed is not the `login` action then redirect to the `login` action.

The `login` action itself is trivial too:

    def login = {
    	if(request.get) render(view:"login")
    	else {
    		def u = User.findByLogin(params.login)
    		if(u) {
    			if(u.password == params.password) {
    				session.user = u
    				redirect(action:"home")
    			}
    			else {
    				render(view:"login", model:[message:"Password incorrect"])
    			}
    		}
    		else {
    			render(view:"login", model:[message:"User not found"])
    		}
    	}
    }