title: What's the proper way to handle insufficient permissions with the Facebook Authentication for Spring Security plugin?
body: <p>I'm using the Spring Security 2.0-RC4 and the Facebook Authentication for Spring Security 0.15.2-CORE2 to allow users to authenticate with a Facebook login.  I request the extra FB permission "email" since I use email as the primary key for my User class, so if the email permission is unselected by the user I need to abort login.  Currently I check for null email in my <code>FacebookAuthService.create()</code> and return null if email was not set.</p>
  
  <p>In the normal case everything works fine.  Login succeeds, I get new User and FacebookUser records created and my User object's email property is updated with the Facebook user's email address.  However, if the user elects to remove email permission during login then I run into problems.</p>
  
  <p>In my <code>FacebookAuthService.create()</code> I check if email was returned (similar to <a href="https://stackoverflow.com/questions/11378351/grails-facebook-plugin-how-to-handle-invalid-user">in this question</a>), and if not return null to abort the authentication process:</p>
  
  <pre><code>FacebookUser create(FacebookAuthToken token) {
      Facebook facebook
      FacebookProfile fbProfile
      try {
          facebook = new FacebookTemplate(token.accessToken.accessToken)
          fbProfile = facebook.userOperations().userProfile
      } catch (org.springframework.social.ApiException apiex) {
          return null
      }
      String email = fbProfile.email
  
      if (!email) {
          return null
      }
      ...
  </code></pre>
  
  <p>When email is null and I return null my security state seems to be messed up.  I have a beforeInterceptor on my controller which gets called after I return null from create():</p>
  
  <pre><code>def beforeInterceptor = {
      def user = springSecurityService.currentUser
      log.trace("${user?.email} - End action ${controllerName}Controller.${actionName}() : returns $model, view ${modelAndView?.viewName}")
  }
  </code></pre>
  
  <p>getCurrentUser() should be returning null but instead it throws an exception:</p>
  
  <pre><code>org.codehaus.groovy.grails.web.errors.GrailsExceptionResolver - NullPointerException occurred when processing request: [GET] /rar/user/home
  Cannot get property 'username' on null object. Stacktrace follows:
  java.lang.NullPointerException: Cannot get property 'username' on null object
      at org.codehaus.groovy.runtime.NullObject.getProperty(NullObject.java:56)
      at org.codehaus.groovy.runtime.InvokerHelper.getProperty(InvokerHelper.java:169)
      at org.codehaus.groovy.runtime.callsite.NullCallSite.getProperty(NullCallSite.java:44)
      at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callGetProperty(AbstractCallSite.java:227)
      at grails.plugin.springsecurity.SpringSecurityService.getCurrentUser(SpringSecurityService.groovy:87)
  
      at grails.plugin.springsecurity.SpringSecurityService$$FastClassBySpringCGLIB$$6e53ab8e.invoke(&lt;generated&gt;)
  ...
  </code></pre>
  
  <p>It seems that SpringSecurityService thinks that someone is logged in because <code>getCurrentUser()</code>'s call to <code>isLoggedIn()</code> returns true, which causes an exception later when principal is null and a property is accessed on the null principal object.</p>
  
  <p>Should I be aborting the Facebook login process in a different way instead of returning null from <code>FacebookAuthService.create()</code>?</p>