title: Why can't i login with spring security and weceem plugin installed in grails framework 1.3.7
body: <p>I'm working on a nearly clean grails 1.3.7 project with weceem 1.0RC2, spring-security-core 1.1.3, spring-security-ui 0.1.2, weceem-spring-security 1.0 and their dependencies installed.</p>
  
  <p>Everything works fine except the user login. When I want to login over <a href="http://localhost:8080/appname/login" rel="nofollow">http://localhost:8080/appname/login</a> i only get the following error message:</p>
  
  <pre><code>Sorry, we were not able to find a user with that username and password.
  </code></pre>
  
  <p>But the user still exists in the database and i get the same error message if i use a user created by spring-security-ui. To encode passwords i'm using springSecurityService.encodePassword('password'). The LoginController was generated by spring-security (s2-quickstart).</p>
  
  <p>I think there could be a problem with the weceem - spring-security bridge, what's your oppinion?</p>
  
  <p>Best regards,
  whitenexx</p>
  
  <pre><code>import grails.converters.JSON
  import javax.servlet.http.HttpServletResponse
  import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils
  import org.springframework.security.authentication.AccountExpiredException
  import org.springframework.security.authentication.CredentialsExpiredException
  import org.springframework.security.authentication.DisabledException
  import org.springframework.security.authentication.LockedException
  import org.springframework.security.core.context.SecurityContextHolder as SCH
  import org.springframework.security.web.WebAttributes
  import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
  
  class LoginController {
  
  /**
   * Dependency injection for the authenticationTrustResolver.
   */
  def authenticationTrustResolver
  
  /**
   * Dependency injection for the springSecurityService.
   */
  def springSecurityService
  
  /**
   * Default action; redirects to 'defaultTargetUrl' if logged in, /login/auth otherwise.
   */
  def index = {
      if (springSecurityService.isLoggedIn()) {
          redirect uri: SpringSecurityUtils.securityConfig.successHandler.defaultTargetUrl
      }
      else {
          redirect action: auth, params: params
      }
  }
  
  /**
   * Show the login page.
   */
  def auth = {
  
      def config = SpringSecurityUtils.securityConfig
  
      if (springSecurityService.isLoggedIn()) {
          redirect uri: config.successHandler.defaultTargetUrl
          return
      }
  
      String view = 'auth'
      String postUrl = "${request.contextPath}${config.apf.filterProcessesUrl}"
      render view: view, model: [postUrl: postUrl,
                  rememberMeParameter: config.rememberMe.parameter]
  }
  
  /**
   * The redirect action for Ajax requests. 
   */
  def authAjax = {
      response.setHeader 'Location', SpringSecurityUtils.securityConfig.auth.ajaxLoginFormUrl
      response.sendError HttpServletResponse.SC_UNAUTHORIZED
  }
  
  /**
   * Show denied page.
   */
  def denied = {
      if (springSecurityService.isLoggedIn() &amp;&amp;
      authenticationTrustResolver.isRememberMe(SCH.context?.authentication)) {
          // have cookie but the page is guarded with IS_AUTHENTICATED_FULLY
          redirect action: full, params: params
      }
  }
  
  /**
   * Login page for users with a remember-me cookie but accessing a IS_AUTHENTICATED_FULLY page.
   */
  def full = {
      def config = SpringSecurityUtils.securityConfig
      render view: 'auth', params: params,
              model: [hasCookie: authenticationTrustResolver.isRememberMe(SCH.context?.authentication),
                  postUrl: "${request.contextPath}${config.apf.filterProcessesUrl}"]
  }
  
  /**
   * Callback after a failed login. Redirects to the auth page with a warning message.
   */
  def authfail = {
  
      def username = session[UsernamePasswordAuthenticationFilter.SPRING_SECURITY_LAST_USERNAME_KEY]
      String msg = ''
      def exception = session[WebAttributes.AUTHENTICATION_EXCEPTION]
      if (exception) {
          if (exception instanceof AccountExpiredException) {
              msg = SpringSecurityUtils.securityConfig.errors.login.expired
          }
          else if (exception instanceof CredentialsExpiredException) {
              msg = SpringSecurityUtils.securityConfig.errors.login.passwordExpired
          }
          else if (exception instanceof DisabledException) {
              msg = SpringSecurityUtils.securityConfig.errors.login.disabled
          }
          else if (exception instanceof LockedException) {
              msg = SpringSecurityUtils.securityConfig.errors.login.locked
          }
          else {
              msg = SpringSecurityUtils.securityConfig.errors.login.fail
          }
      }
  
      if (springSecurityService.isAjax(request)) {
          render([error: msg] as JSON)
      }
      else {
          flash.message = msg
          redirect action: auth, params: params
      }
  }
  
  /**
   * The Ajax success redirect url.
   */
  def ajaxSuccess = {
      render([success: true, username: springSecurityService.authentication.name] as JSON)
  }
  
  /**
   * The Ajax denied redirect url.
   */
  def ajaxDenied = {
      render([error: 'access denied'] as JSON)
  }
  }
  </code></pre>