You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Narcom <na...@yahoo.com> on 2009/10/29 08:48:52 UTC
Spring stand alone client
I noticed that java web start GUI application does not start for “Apache
Shiro :: Samples :: Spring”.
I use stand alone java program to access tomcat. Here its code
PropertyConfigurator.configure("web/WEB-INF/log.properties");
ctx = new
FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
LoginManagerRemote loginManager = (LoginManagerRemote)
ctx.getBean("loginManager");
UserRemote user = loginManager.login();
log.info("user name: " + user.getName());
log.info("sesssionId: " + user.getSessionId());
SampleManager sampleManager = (SampleManager) ctx.getBean("sampleManager");
sampleManager.secureMethod1();
So I write 2 spring remote beans
first makes login and return jsessionId.
<bean name="/login"
class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
<property name="service" ref="loginManager"/>
<property name="serviceInterface"
value="com.springbook.LoginManagerRemote"/>
</bean>
second is secure bean
<bean name="/sampleManager"
class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
<property name="service" ref="sampleManager"/>
<property name="serviceInterface"
value="my.samples.shiro.spring.SampleManager"/>
<property name="remoteInvocationExecutor"
ref="secureRemoteInvocationExecutor"/>
</bean>
What should I do to call secure bean from my standalone client?
If I just call it after login I get
Exception in thread "main" java.lang.IllegalStateException: No
SecurityManager accessible to the calling code, either bound to the
org.apache.shiro.util.ThreadContext or as a vm static singleton. This is an
invalid application configuration.
at
org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:115)
--
View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3910311.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Spring stand alone client
Posted by Les Hazlewood <lh...@apache.org>.
This feature - any rich client participating in a server side session
- is a powerful feature unique to Shiro. You must use Shiro's native
sessions. Servlet container HTTP sessions can't support this
functionality for any protocols other than HTTP. Shiro's native
session mode can.
Does this help?
Regards,
Les
On Mon, Nov 2, 2009 at 2:43 PM, Narcom <na...@yahoo.com> wrote:
>
> I figured out what is wrong using "http monitor" and debugger...
> When I use shiro SecureRemoteInvocationFactory for spring remoting it does
> not send http session cookies/headers at all. but instead somehow serialize
> and wrap them into into server request. On server side Shiro unwrap recieved
> object and extracts that server id... but problem is that Tomcat have no
> idea that it was request with session... All this happens if you use not
> "native" session storage mode but "http" session mode and
> DefaultSecurityManager.
>
> If I switched to native session mode then everything is working.
>
> It seems to me that to use standard http session I need to use
> DefaultWebSecurityManager but I do not know how to initiate it on client
> side. any ideas?
>
>
> Narcom wrote:
>>
>> I managed to call remote "secure" spring bean at last... using this code
>> PropertyConfigurator.configure("web/WEB-INF/log.properties");
>> ctx = new
>> FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
>>
>> DefaultSecurityManager securityManager = new
>> DefaultSecurityManager();
>> securityManager.setRealm(new PropertiesRealm());
>>
>> SecurityUtils.setSecurityManager(securityManager);
>>
>> LoginManagerRemote loginManager = (LoginManagerRemote)
>> ctx.getBean("loginManager");
>> UserRemote user = loginManager.login();
>> String sessionId = user.getSessionId();
>> log.info("user name: " + user.getName());
>> log.info("sesssionId: " + sessionId);
>>
>> SimpleSession session = new SimpleSession();
>> session.setId(sessionId);
>>
>> Subject subject = new
>> Subject.Builder().session(session).buildSubject();
>>
>> Session sessionLocal = subject.getSession(false);
>> if(sessionLocal != null){
>> log.info("session.getId(): " + sessionLocal.getId());
>> } else {
>> log.info("session: null");
>> }
>>
>> subject.execute(new Runnable() {
>>
>> public void run() {
>> SampleManager sampleManager = (SampleManager)
>> ctx.getBean("sampleManager");
>> String result = sampleManager.secureMethod1();
>> log.info(result);
>> }
>> });
>>
>> but now I have another problem. When I call secureMethod1() it execute
>> fine only if I do not check authorization.
>> this what I get on server side:
>> 2009-11-02 14:50:04,656 DEBUG
>> (org.apache.shiro.authc.credential.SimpleCredentialsMatcher:100)
>> Performing credentials equality check for tokenCredentials of type
>> [org.apache.shiro.crypto.hash.Sha256Hash and accountCredentials of type
>> [org.apache.shiro.crypto.hash.Sha256Hash]
>> 2009-11-02 14:50:04,656 DEBUG
>> (org.apache.shiro.authc.AbstractAuthenticator:217) Authentication
>> successful for token [org.apache.shiro.authc.UsernamePasswordToken -
>> user1, rememberMe=true]. Returned account
>> [org.apache.shiro.subject.SimplePrincipalCollection@4930af45]
>> 2009-11-02 14:50:04,687 DEBUG
>> (org.apache.shiro.web.attr.AbstractWebAttribute:171) No 'editorClass'
>> property set - returning value.toString() as the string value for method
>> argument.
>> 2009-11-02 14:50:04,687 DEBUG
>> (org.apache.shiro.web.attr.CookieAttribute:350) Added Cookie [rememberMe]
>> to path [/SpringRemoting] with value
>> [UwP13UzjVUceLBNWh+sYM01JWOSbBOwc1ZLySIws0IdnkcWeD/yWeH0eIycwHaI8MRKPyenBr76EoLkEZnXSz4i27cTTUps5qOgU/ZQLdvIOxlZxmT9RlUvKT6zopnQrSpdsCNaruG/Op/XEoJcdNLI9rJCCyMKN3em5wl8GrWTIzKS4hzHombGBEW4EPS9jv40HV4mIS2sUFXm5MlOptr99e1A6eKYxlLrldk2/yqw29nWohE0sIjO7tRF9mOAZUeC/Fem6K4S82LbXAJ6p0oNg3MP7dbFSkeeDF2CwFJvvi5xVrGyF0aKk8JzBHKzmRgLAreVAMGR0L2hGHOgIP/uup6KzE3QFZJpPSCmtcRZASMTpLxTpiiTHhVmB9Hf42eGB9vfoR9QFfK0U+in7fyrWyyAs3GPdM884yP9B8YdVfqUzqWhbzMDdUgS0PKpc3QsBDOqdsLzOpvUImFdomuk+RZ98i28s/KP1puAwmeo=]
>> to the HttpServletResponse
>> 2009-11-02 14:50:04,812 INFO (com.springbook.LoginManagerBean:43)
>> 70931A960971B2477A95A27B296D4C0D
>> 2009-11-02 14:50:04,843 DEBUG
>> (org.apache.shiro.mgt.DefaultSecurityManager:384) Context referenced
>> sessionId is invalid. Ignoring and creating an anonymous (session-less)
>> Subject instance.
>> org.apache.shiro.session.UnknownSessionException: There is no session with
>> id [70931A960971B2477A95A27B296D4C0D]
>> at
>> org.apache.shiro.session.mgt.AbstractSessionManager.getSession(AbstractSessionManager.java:249)
>> at
>> org.apache.shiro.session.mgt.AbstractSessionManager.checkValid(AbstractSessionManager.java:265)
>> at
>> org.apache.shiro.mgt.SessionsSecurityManager.checkValid(SessionsSecurityManager.java:294)
>> at
>> org.apache.shiro.mgt.DefaultSecurityManager.getSession(DefaultSecurityManager.java:192)
>> at
>> org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:380)
>> at
>> org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:343)
>> at
>> org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:703)
>> at
>> org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor.invoke(SecureRemoteInvocationExecutor.java:106)
>> at
>> org.springframework.remoting.support.RemoteInvocationBasedExporter.invoke(RemoteInvocationBasedExporter.java:78)
>> at
>> org.springframework.remoting.support.RemoteInvocationBasedExporter.invokeAndCreateResult(RemoteInvocationBasedExporter.java:114)
>> at
>> org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter.handleRequest(HttpInvokerServiceExporter.java:117)
>> at
>> org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter.handle(HttpRequestHandlerAdapter.java:49)
>> at
>> org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:874)
>> at
>> org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:808)
>> at
>> org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:476)
>> at
>> org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:441)
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>> at
>> org.apache.shiro.web.servlet.ShiroFilter.executeChain(ShiroFilter.java:687)
>> at
>> org.apache.shiro.web.servlet.ShiroFilter.doFilterInternal(ShiroFilter.java:616)
>> at
>> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:81)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>> at
>> org.netbeans.modules.web.monitor.server.MonitorFilter.doFilter(MonitorFilter.java:390)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
>> at
>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
>> at
>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
>> at
>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
>> at
>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
>> at
>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
>> at
>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
>> at
>> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
>> at
>> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
>> at
>> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
>> at java.lang.Thread.run(Thread.java:619)
>> 2009-11-02 14:50:04,906 INFO
>> (my.samples.shiro.spring.DefaultSampleManager:91) Secure method 1
>> called...
>> 2009-11-02 14:50:04,906 INFO
>> (my.samples.shiro.spring.DefaultSampleManager:96)
>> currentUser.isAuthenticated(): false
>> 2009-11-02 14:50:04,906 INFO
>> (my.samples.shiro.spring.DefaultSampleManager:101) session: null
>>
>> note this line "There is no session with id
>> [70931A960971B2477A95A27B296D4C0D]" but this sessionId was created on
>> previuos call and send to client and submitted to Subject session. this is
>> client output:
>>
>> 2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:65) user
>> name: user1
>> 2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:66)
>> sesssionId: 70931A960971B2477A95A27B296D4C0D
>> 2009-11-02 14:50:04,828 DEBUG
>> (org.apache.shiro.mgt.DefaultSecurityManager:371) Context already contains
>> a session. Returning.
>> 2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:99)
>> session.getId(): 70931A960971B2477A95A27B296D4C0D
>> 2009-11-02 14:50:04,906 INFO (com.springbook.client.RemotingTest:109)
>> Secure method 1 called...
>>
>> so it looks like by some reason session created before is not restored by
>> shiro...
>>
>> how to fix it?
>>
>>
>>
>
> --
> View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3934177.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Spring stand alone client
Posted by Narcom <na...@yahoo.com>.
I figured out what is wrong using "http monitor" and debugger...
When I use shiro SecureRemoteInvocationFactory for spring remoting it does
not send http session cookies/headers at all. but instead somehow serialize
and wrap them into into server request. On server side Shiro unwrap recieved
object and extracts that server id... but problem is that Tomcat have no
idea that it was request with session... All this happens if you use not
"native" session storage mode but "http" session mode and
DefaultSecurityManager.
If I switched to native session mode then everything is working.
It seems to me that to use standard http session I need to use
DefaultWebSecurityManager but I do not know how to initiate it on client
side. any ideas?
Narcom wrote:
>
> I managed to call remote "secure" spring bean at last... using this code
> PropertyConfigurator.configure("web/WEB-INF/log.properties");
> ctx = new
> FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
>
> DefaultSecurityManager securityManager = new
> DefaultSecurityManager();
> securityManager.setRealm(new PropertiesRealm());
>
> SecurityUtils.setSecurityManager(securityManager);
>
> LoginManagerRemote loginManager = (LoginManagerRemote)
> ctx.getBean("loginManager");
> UserRemote user = loginManager.login();
> String sessionId = user.getSessionId();
> log.info("user name: " + user.getName());
> log.info("sesssionId: " + sessionId);
>
> SimpleSession session = new SimpleSession();
> session.setId(sessionId);
>
> Subject subject = new
> Subject.Builder().session(session).buildSubject();
>
> Session sessionLocal = subject.getSession(false);
> if(sessionLocal != null){
> log.info("session.getId(): " + sessionLocal.getId());
> } else {
> log.info("session: null");
> }
>
> subject.execute(new Runnable() {
>
> public void run() {
> SampleManager sampleManager = (SampleManager)
> ctx.getBean("sampleManager");
> String result = sampleManager.secureMethod1();
> log.info(result);
> }
> });
>
> but now I have another problem. When I call secureMethod1() it execute
> fine only if I do not check authorization.
> this what I get on server side:
> 2009-11-02 14:50:04,656 DEBUG
> (org.apache.shiro.authc.credential.SimpleCredentialsMatcher:100)
> Performing credentials equality check for tokenCredentials of type
> [org.apache.shiro.crypto.hash.Sha256Hash and accountCredentials of type
> [org.apache.shiro.crypto.hash.Sha256Hash]
> 2009-11-02 14:50:04,656 DEBUG
> (org.apache.shiro.authc.AbstractAuthenticator:217) Authentication
> successful for token [org.apache.shiro.authc.UsernamePasswordToken -
> user1, rememberMe=true]. Returned account
> [org.apache.shiro.subject.SimplePrincipalCollection@4930af45]
> 2009-11-02 14:50:04,687 DEBUG
> (org.apache.shiro.web.attr.AbstractWebAttribute:171) No 'editorClass'
> property set - returning value.toString() as the string value for method
> argument.
> 2009-11-02 14:50:04,687 DEBUG
> (org.apache.shiro.web.attr.CookieAttribute:350) Added Cookie [rememberMe]
> to path [/SpringRemoting] with value
> [UwP13UzjVUceLBNWh+sYM01JWOSbBOwc1ZLySIws0IdnkcWeD/yWeH0eIycwHaI8MRKPyenBr76EoLkEZnXSz4i27cTTUps5qOgU/ZQLdvIOxlZxmT9RlUvKT6zopnQrSpdsCNaruG/Op/XEoJcdNLI9rJCCyMKN3em5wl8GrWTIzKS4hzHombGBEW4EPS9jv40HV4mIS2sUFXm5MlOptr99e1A6eKYxlLrldk2/yqw29nWohE0sIjO7tRF9mOAZUeC/Fem6K4S82LbXAJ6p0oNg3MP7dbFSkeeDF2CwFJvvi5xVrGyF0aKk8JzBHKzmRgLAreVAMGR0L2hGHOgIP/uup6KzE3QFZJpPSCmtcRZASMTpLxTpiiTHhVmB9Hf42eGB9vfoR9QFfK0U+in7fyrWyyAs3GPdM884yP9B8YdVfqUzqWhbzMDdUgS0PKpc3QsBDOqdsLzOpvUImFdomuk+RZ98i28s/KP1puAwmeo=]
> to the HttpServletResponse
> 2009-11-02 14:50:04,812 INFO (com.springbook.LoginManagerBean:43)
> 70931A960971B2477A95A27B296D4C0D
> 2009-11-02 14:50:04,843 DEBUG
> (org.apache.shiro.mgt.DefaultSecurityManager:384) Context referenced
> sessionId is invalid. Ignoring and creating an anonymous (session-less)
> Subject instance.
> org.apache.shiro.session.UnknownSessionException: There is no session with
> id [70931A960971B2477A95A27B296D4C0D]
> at
> org.apache.shiro.session.mgt.AbstractSessionManager.getSession(AbstractSessionManager.java:249)
> at
> org.apache.shiro.session.mgt.AbstractSessionManager.checkValid(AbstractSessionManager.java:265)
> at
> org.apache.shiro.mgt.SessionsSecurityManager.checkValid(SessionsSecurityManager.java:294)
> at
> org.apache.shiro.mgt.DefaultSecurityManager.getSession(DefaultSecurityManager.java:192)
> at
> org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:380)
> at
> org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:343)
> at
> org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:703)
> at
> org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor.invoke(SecureRemoteInvocationExecutor.java:106)
> at
> org.springframework.remoting.support.RemoteInvocationBasedExporter.invoke(RemoteInvocationBasedExporter.java:78)
> at
> org.springframework.remoting.support.RemoteInvocationBasedExporter.invokeAndCreateResult(RemoteInvocationBasedExporter.java:114)
> at
> org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter.handleRequest(HttpInvokerServiceExporter.java:117)
> at
> org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter.handle(HttpRequestHandlerAdapter.java:49)
> at
> org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:874)
> at
> org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:808)
> at
> org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:476)
> at
> org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:441)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> at
> org.apache.shiro.web.servlet.ShiroFilter.executeChain(ShiroFilter.java:687)
> at
> org.apache.shiro.web.servlet.ShiroFilter.doFilterInternal(ShiroFilter.java:616)
> at
> org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:81)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> at
> org.netbeans.modules.web.monitor.server.MonitorFilter.doFilter(MonitorFilter.java:390)
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
> at
> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
> at
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
> at
> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
> at java.lang.Thread.run(Thread.java:619)
> 2009-11-02 14:50:04,906 INFO
> (my.samples.shiro.spring.DefaultSampleManager:91) Secure method 1
> called...
> 2009-11-02 14:50:04,906 INFO
> (my.samples.shiro.spring.DefaultSampleManager:96)
> currentUser.isAuthenticated(): false
> 2009-11-02 14:50:04,906 INFO
> (my.samples.shiro.spring.DefaultSampleManager:101) session: null
>
> note this line "There is no session with id
> [70931A960971B2477A95A27B296D4C0D]" but this sessionId was created on
> previuos call and send to client and submitted to Subject session. this is
> client output:
>
> 2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:65) user
> name: user1
> 2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:66)
> sesssionId: 70931A960971B2477A95A27B296D4C0D
> 2009-11-02 14:50:04,828 DEBUG
> (org.apache.shiro.mgt.DefaultSecurityManager:371) Context already contains
> a session. Returning.
> 2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:99)
> session.getId(): 70931A960971B2477A95A27B296D4C0D
> 2009-11-02 14:50:04,906 INFO (com.springbook.client.RemotingTest:109)
> Secure method 1 called...
>
> so it looks like by some reason session created before is not restored by
> shiro...
>
> how to fix it?
>
>
>
--
View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3934177.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Spring stand alone client
Posted by Narcom <na...@yahoo.com>.
I managed to call remote "secure" spring bean at last... using this code
PropertyConfigurator.configure("web/WEB-INF/log.properties");
ctx = new
FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
DefaultSecurityManager securityManager = new
DefaultSecurityManager();
securityManager.setRealm(new PropertiesRealm());
SecurityUtils.setSecurityManager(securityManager);
LoginManagerRemote loginManager = (LoginManagerRemote)
ctx.getBean("loginManager");
UserRemote user = loginManager.login();
String sessionId = user.getSessionId();
log.info("user name: " + user.getName());
log.info("sesssionId: " + sessionId);
SimpleSession session = new SimpleSession();
session.setId(sessionId);
Subject subject = new
Subject.Builder().session(session).buildSubject();
Session sessionLocal = subject.getSession(false);
if(sessionLocal != null){
log.info("session.getId(): " + sessionLocal.getId());
} else {
log.info("session: null");
}
subject.execute(new Runnable() {
public void run() {
SampleManager sampleManager = (SampleManager)
ctx.getBean("sampleManager");
String result = sampleManager.secureMethod1();
log.info(result);
}
});
but now I have another problem. When I call secureMethod1() it execute fine
only if I do not check authorization.
this what I get on server side:
2009-11-02 14:50:04,656 DEBUG
(org.apache.shiro.authc.credential.SimpleCredentialsMatcher:100) Performing
credentials equality check for tokenCredentials of type
[org.apache.shiro.crypto.hash.Sha256Hash and accountCredentials of type
[org.apache.shiro.crypto.hash.Sha256Hash]
2009-11-02 14:50:04,656 DEBUG
(org.apache.shiro.authc.AbstractAuthenticator:217) Authentication successful
for token [org.apache.shiro.authc.UsernamePasswordToken - user1,
rememberMe=true]. Returned account
[org.apache.shiro.subject.SimplePrincipalCollection@4930af45]
2009-11-02 14:50:04,687 DEBUG
(org.apache.shiro.web.attr.AbstractWebAttribute:171) No 'editorClass'
property set - returning value.toString() as the string value for method
argument.
2009-11-02 14:50:04,687 DEBUG
(org.apache.shiro.web.attr.CookieAttribute:350) Added Cookie [rememberMe] to
path [/SpringRemoting] with value
[UwP13UzjVUceLBNWh+sYM01JWOSbBOwc1ZLySIws0IdnkcWeD/yWeH0eIycwHaI8MRKPyenBr76EoLkEZnXSz4i27cTTUps5qOgU/ZQLdvIOxlZxmT9RlUvKT6zopnQrSpdsCNaruG/Op/XEoJcdNLI9rJCCyMKN3em5wl8GrWTIzKS4hzHombGBEW4EPS9jv40HV4mIS2sUFXm5MlOptr99e1A6eKYxlLrldk2/yqw29nWohE0sIjO7tRF9mOAZUeC/Fem6K4S82LbXAJ6p0oNg3MP7dbFSkeeDF2CwFJvvi5xVrGyF0aKk8JzBHKzmRgLAreVAMGR0L2hGHOgIP/uup6KzE3QFZJpPSCmtcRZASMTpLxTpiiTHhVmB9Hf42eGB9vfoR9QFfK0U+in7fyrWyyAs3GPdM884yP9B8YdVfqUzqWhbzMDdUgS0PKpc3QsBDOqdsLzOpvUImFdomuk+RZ98i28s/KP1puAwmeo=]
to the HttpServletResponse
2009-11-02 14:50:04,812 INFO (com.springbook.LoginManagerBean:43)
70931A960971B2477A95A27B296D4C0D
2009-11-02 14:50:04,843 DEBUG
(org.apache.shiro.mgt.DefaultSecurityManager:384) Context referenced
sessionId is invalid. Ignoring and creating an anonymous (session-less)
Subject instance.
org.apache.shiro.session.UnknownSessionException: There is no session with
id [70931A960971B2477A95A27B296D4C0D]
at
org.apache.shiro.session.mgt.AbstractSessionManager.getSession(AbstractSessionManager.java:249)
at
org.apache.shiro.session.mgt.AbstractSessionManager.checkValid(AbstractSessionManager.java:265)
at
org.apache.shiro.mgt.SessionsSecurityManager.checkValid(SessionsSecurityManager.java:294)
at
org.apache.shiro.mgt.DefaultSecurityManager.getSession(DefaultSecurityManager.java:192)
at
org.apache.shiro.mgt.DefaultSecurityManager.resolveSession(DefaultSecurityManager.java:380)
at
org.apache.shiro.mgt.DefaultSecurityManager.createSubject(DefaultSecurityManager.java:343)
at
org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:703)
at
org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor.invoke(SecureRemoteInvocationExecutor.java:106)
at
org.springframework.remoting.support.RemoteInvocationBasedExporter.invoke(RemoteInvocationBasedExporter.java:78)
at
org.springframework.remoting.support.RemoteInvocationBasedExporter.invokeAndCreateResult(RemoteInvocationBasedExporter.java:114)
at
org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter.handleRequest(HttpInvokerServiceExporter.java:117)
at
org.springframework.web.servlet.mvc.HttpRequestHandlerAdapter.handle(HttpRequestHandlerAdapter.java:49)
at
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:874)
at
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:808)
at
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:476)
at
org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:441)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:637)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.shiro.web.servlet.ShiroFilter.executeChain(ShiroFilter.java:687)
at
org.apache.shiro.web.servlet.ShiroFilter.doFilterInternal(ShiroFilter.java:616)
at
org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:81)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.netbeans.modules.web.monitor.server.MonitorFilter.doFilter(MonitorFilter.java:390)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
at
org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
at java.lang.Thread.run(Thread.java:619)
2009-11-02 14:50:04,906 INFO
(my.samples.shiro.spring.DefaultSampleManager:91) Secure method 1 called...
2009-11-02 14:50:04,906 INFO
(my.samples.shiro.spring.DefaultSampleManager:96)
currentUser.isAuthenticated(): false
2009-11-02 14:50:04,906 INFO
(my.samples.shiro.spring.DefaultSampleManager:101) session: null
note this line "There is no session with id
[70931A960971B2477A95A27B296D4C0D]" but this sessionId was created on
previuos call and send to client and submitted to Subject session. this is
client output:
2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:65) user
name: user1
2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:66)
sesssionId: 70931A960971B2477A95A27B296D4C0D
2009-11-02 14:50:04,828 DEBUG
(org.apache.shiro.mgt.DefaultSecurityManager:371) Context already contains a
session. Returning.
2009-11-02 14:50:04,828 INFO (com.springbook.client.RemotingTest:99)
session.getId(): 70931A960971B2477A95A27B296D4C0D
2009-11-02 14:50:04,906 INFO (com.springbook.client.RemotingTest:109) Secure
method 1 called...
so it looks like by some reason session created before is not restored by
shiro...
how to fix it?
--
View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3931076.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Spring stand alone client
Posted by Narcom <na...@yahoo.com>.
this what happens on server side when I call my "Login" remote bean
2009-10-30 09:34:01,718 DEBUG
(org.apache.shiro.authc.credential.SimpleCredentialsMatcher:100)
Performing credentials equality check for tokenCredentials of type
[org.apache.shiro.crypto.hash.Sha256Hash and accountCredentials of type
[org.apache.shiro.crypto.hash.Sha256Hash]
2009-10-30 09:34:01,718 DEBUG
(org.apache.shiro.authc.AbstractAuthenticator:217) Authentication
successful for token [org.apache.shiro.authc.UsernamePasswordToken - user1,
rememberMe=true]. Returned account
[org.apache.shiro.subject.SimplePrincipalCollection@4930af45]
2009-10-30 09:34:01,796 DEBUG
(org.apache.shiro.web.attr.AbstractWebAttribute:171) No 'editorClass'
property set - returning value.toString() as the string value for method
argument.
2009-10-30 09:34:01,796 DEBUG
(org.apache.shiro.web.attr.CookieAttribute:350) Added Cookie
[rememberMe] to path [/SpringRemoting] with value
[UwP13UzjVUceLBNWh+sYM01JWOSbBOwc1ZLySIws0IdnkcWeD/yWeH0eIycwHaI8MRKPyenBr76EoLkEZnXSz4i27cTTUps5qOgU/ZQLdvIOxlZxmT9RlUvKT6zopnQrSpdsCNaruG/Op/XEoJcdNLI9rJCCyMKN3em5wl8GrWTIzKS4hzHombGBEW4EPS9jv40HV4mIS2sUFXm5MlOptr99e1A6eKYxlLrldk2/yqw29nWohE0sIjO7tRF9mOAZUeC/Fem6K4S82LbXAJ6p0oNg3MP7dbFSkeeDF2CwFJvvi5xVrGyF0aKk8JzBHKzmRgLAreVAMGR0L2hGHOgIP/uup6KzE3QFZJpPSCmtcRZASMTpLxTpiiTHhVmB9Hf42eGB9vfoR9QFfK0U+in7fyrWyyAs3GPdM884yP9B8YdVfqUzqWhbzMDdUgS0PKpc3QsBDOqdsLzOpvUImFdomuk+RZ98i28s/KP1puAwmeo=]
to the HttpServletResponse
2009-10-30 09:34:01,890 DEBUG
(org.apache.shiro.session.mgt.AbstractValidatingSessionManager:233)
No sessionValidationScheduler set. Attempting to create default instance.
2009-10-30 09:34:01,890 INFO
(org.apache.shiro.session.mgt.AbstractValidatingSessionManager:250)
Enabling session validation scheduler...
2009-10-30 09:34:01,906 DEBUG
(org.apache.shiro.session.mgt.DefaultSessionManager:158) Creating new
EIS record for new session instance
[org.apache.shiro.session.mgt.SimpleSession,id=null]
2009-10-30 09:34:01,906 DEBUG
(org.apache.shiro.web.attr.AbstractWebAttribute:171) No 'editorClass'
property set - returning value.toString() as the string value for method
argument.
2009-10-30 09:34:01,984 DEBUG
(org.apache.shiro.web.attr.CookieAttribute:350) Added Cookie
[JSESSIONID] to path [/SpringRemoting] with value
[9d70ee0a-94bf-4a28-b07b-6b7212b0066a] to the HttpServletResponse
As I understand there is no problem at server side. Session is created and
id is returned to client.
this is what I get on client:
LoginManagerRemote loginManager = (LoginManagerRemote)
ctx.getBean("loginManager");
UserRemote user = loginManager.login();
log.info("user name: " + user.getName());
log.info("sesssionId: " + user.getSessionId());
2009-10-30 09:34:02,000 INFO
(com.springbook.client.RemotingTest:51) user name: user1
2009-10-30 09:34:02,000 INFO
(com.springbook.client.RemotingTest:52) sesssionId:
9d70ee0a-94bf-4a28-b07b-6b7212b0066a
As you see the same session I get on client. so for a while everythink is
ok.
but when I call secutity bean.
Subject subject = new
Subject.Builder().sessionId(user.getSessionId()).buildSubject();
ThreadState threadState = new SubjectThreadState(subject);
threadState.bind();
try {
SampleManager sampleManager = (SampleManager)
ctx.getBean("sampleManager");
//sampleManager.secureMethod1();
} finally {
threadState.clear();
}
I get
Exception in thread "main" java.lang.IllegalStateException: No
SecurityManager accessible to the calling code, either bound to the
org.apache.shiro.util.ThreadContext or as a vm static singleton. This is an
invalid application configuration.
at
org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:115)
at org.apache.shiro.subject.Subject$Builder.<init>(Subject.java:550)
at com.springbook.client.RemotingTest.test(RemotingTest.java:67)
at com.springbook.client.RemotingTest.main(RemotingTest.java:36)
As I understand "Subject subject = new
Subject.Builder().sessionId(user.getSessionId()).buildSubject();"
do not create any SecurityManager but remote invocation needs one so... how
to solve it.
And about spring web example. it looks like jnlp uses system property
<property name="shiro.session.id" value="some session id"/> but if I need
authorization against multiple sources?
And I do no understand: WebStartView line 163 (test.setSampleManager(new
DefaultSampleManager());)
why new instance of DefaultSampleManager is inited? shouldn't it be taken
from spring ben instead as remote bean?
Les Hazlewood-2 wrote:
>
> Hi Narcom,
>
> You only want to use the Subject.Builder in special situations. You
> should almost always use SecurityUtils.getSubject().
>
> The reason this is failing for you is that the user.getSessionId()
> call is trying to reference a session that doesn't exist yet. When
> you instantiate a new SecurityManager, it in turn uses a new
> SessionManager, and that SessionManager doesn't have any sessions yet.
> I think you'd want to reference the remote SecurityManager instead.
>
> That is:
>
> Subject subject = new
> Subject.Builder(remoteSecurityManager).sessionId(user.getSessionId()).buildSubject();
>
> I'll check out the WebStart example this weekend to see what might be
> wrong - it hasn't been updated in a while.
>
> Cheers,
>
> Les
>
> On Thu, Oct 29, 2009 at 2:00 PM, Narcom <na...@yahoo.com> wrote:
>>
>> I am not sure it is some kind of "issue". May be I do not understand
>> smth. It
>> looks like on secure bean call it tries to get SecurityManager but cannot
>> find one because I did not inited one (but should I create one?)
>>
>> If I create one as mentioned in Quickstart llike this
>> DefaultSecurityManager securityManager = new DefaultSecurityManager();
>> SecurityUtils.setSecurityManager( securityManager );
>> Subject subject = new
>> Subject.Builder().sessionId(user.getSessionId()).buildSubject();
>> ThreadState threadState = new SubjectThreadState(subject);
>> threadState.bind();
>> try {
>> SampleManager sampleManager = (SampleManager)
>> ctx.getBean("sampleManager");
>> //sampleManager.secureMethod1();
>> } finally {
>> threadState.clear();
>> }
>>
>> I get this exception
>> org.apache.shiro.session.UnknownSessionException: There is no session
>> with
>> id [f493926d-b5dc-4488-945e-1aa97145dc7a]
>> at
>> org.apache.shiro.session.mgt.eis.CachingSessionDAO.readSession(CachingSessionDAO.java:281)
>> at
>> org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSessionFromDataSource(DefaultSessionManager.java:202)
>> .....
>> at
>> org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:703)
>> at com.springbook.client.RemotingTest.test(RemotingTest.java:67)
>> at com.springbook.client.RemotingTest.main(RemotingTest.java:36)
>>
>> Should be SecurityManager inited automatically on Subject creation i.e.
>> Subject subject = new
>> Subject.Builder().sessionId(user.getSessionId()).buildSubject();
>>
>> ?
>>
>>
>> Les Hazlewood-2 wrote:
>>>
>>> Hi Narcom,
>>>
>>> Can you please re-post this along with the full stack trace (not just
>>> the SecurityUtils.getSecurityManager line) in a Jira issue? That way
>>> It won't get lost.
>>>
>>> - Les
>>>
>>> On Thu, Oct 29, 2009 at 3:48 AM, Narcom <na...@yahoo.com> wrote:
>>>>
>>>> I noticed that java web start GUI application does not start for
>>>> “Apache
>>>> Shiro :: Samples :: Spring”.
>>>>
>>>> I use stand alone java program to access tomcat. Here its code
>>>>
>>>> PropertyConfigurator.configure("web/WEB-INF/log.properties");
>>>> ctx = new
>>>> FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
>>>> LoginManagerRemote loginManager = (LoginManagerRemote)
>>>> ctx.getBean("loginManager");
>>>> UserRemote user = loginManager.login();
>>>> log.info("user name: " + user.getName());
>>>> log.info("sesssionId: " + user.getSessionId());
>>>>
>>>> SampleManager sampleManager = (SampleManager)
>>>> ctx.getBean("sampleManager");
>>>> sampleManager.secureMethod1();
>>>>
>>>> So I write 2 spring remote beans
>>>> first makes login and return jsessionId.
>>>> <bean name="/login"
>>>> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
>>>> <property name="service" ref="loginManager"/>
>>>> <property name="serviceInterface"
>>>> value="com.springbook.LoginManagerRemote"/>
>>>> </bean>
>>>>
>>>> second is secure bean
>>>>
>>>> <bean name="/sampleManager"
>>>> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
>>>> <property name="service" ref="sampleManager"/>
>>>> <property name="serviceInterface"
>>>> value="my.samples.shiro.spring.SampleManager"/>
>>>> <property name="remoteInvocationExecutor"
>>>> ref="secureRemoteInvocationExecutor"/>
>>>> </bean>
>>>>
>>>> What should I do to call secure bean from my standalone client?
>>>>
>>>> If I just call it after login I get
>>>>
>>>> Exception in thread "main" java.lang.IllegalStateException: No
>>>> SecurityManager accessible to the calling code, either bound to the
>>>> org.apache.shiro.util.ThreadContext or as a vm static singleton. This
>>>> is
>>>> an
>>>> invalid application configuration.
>>>> at
>>>> org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:115)
>>>>
>>>> --
>>>> View this message in context:
>>>> http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3910311.html
>>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>>
>>>
>>>
>>
>> --
>> View this message in context:
>> http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3914503.html
>> Sent from the Shiro User mailing list archive at Nabble.com.
>>
>
>
--
View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3917279.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Spring stand alone client
Posted by Les Hazlewood <lh...@apache.org>.
Hi Narcom,
You only want to use the Subject.Builder in special situations. You
should almost always use SecurityUtils.getSubject().
The reason this is failing for you is that the user.getSessionId()
call is trying to reference a session that doesn't exist yet. When
you instantiate a new SecurityManager, it in turn uses a new
SessionManager, and that SessionManager doesn't have any sessions yet.
I think you'd want to reference the remote SecurityManager instead.
That is:
Subject subject = new
Subject.Builder(remoteSecurityManager).sessionId(user.getSessionId()).buildSubject();
I'll check out the WebStart example this weekend to see what might be
wrong - it hasn't been updated in a while.
Cheers,
Les
On Thu, Oct 29, 2009 at 2:00 PM, Narcom <na...@yahoo.com> wrote:
>
> I am not sure it is some kind of "issue". May be I do not understand smth. It
> looks like on secure bean call it tries to get SecurityManager but cannot
> find one because I did not inited one (but should I create one?)
>
> If I create one as mentioned in Quickstart llike this
> DefaultSecurityManager securityManager = new DefaultSecurityManager();
> SecurityUtils.setSecurityManager( securityManager );
> Subject subject = new
> Subject.Builder().sessionId(user.getSessionId()).buildSubject();
> ThreadState threadState = new SubjectThreadState(subject);
> threadState.bind();
> try {
> SampleManager sampleManager = (SampleManager)
> ctx.getBean("sampleManager");
> //sampleManager.secureMethod1();
> } finally {
> threadState.clear();
> }
>
> I get this exception
> org.apache.shiro.session.UnknownSessionException: There is no session with
> id [f493926d-b5dc-4488-945e-1aa97145dc7a]
> at
> org.apache.shiro.session.mgt.eis.CachingSessionDAO.readSession(CachingSessionDAO.java:281)
> at
> org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSessionFromDataSource(DefaultSessionManager.java:202)
> .....
> at
> org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:703)
> at com.springbook.client.RemotingTest.test(RemotingTest.java:67)
> at com.springbook.client.RemotingTest.main(RemotingTest.java:36)
>
> Should be SecurityManager inited automatically on Subject creation i.e.
> Subject subject = new
> Subject.Builder().sessionId(user.getSessionId()).buildSubject();
>
> ?
>
>
> Les Hazlewood-2 wrote:
>>
>> Hi Narcom,
>>
>> Can you please re-post this along with the full stack trace (not just
>> the SecurityUtils.getSecurityManager line) in a Jira issue? That way
>> It won't get lost.
>>
>> - Les
>>
>> On Thu, Oct 29, 2009 at 3:48 AM, Narcom <na...@yahoo.com> wrote:
>>>
>>> I noticed that java web start GUI application does not start for “Apache
>>> Shiro :: Samples :: Spring”.
>>>
>>> I use stand alone java program to access tomcat. Here its code
>>>
>>> PropertyConfigurator.configure("web/WEB-INF/log.properties");
>>> ctx = new
>>> FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
>>> LoginManagerRemote loginManager = (LoginManagerRemote)
>>> ctx.getBean("loginManager");
>>> UserRemote user = loginManager.login();
>>> log.info("user name: " + user.getName());
>>> log.info("sesssionId: " + user.getSessionId());
>>>
>>> SampleManager sampleManager = (SampleManager)
>>> ctx.getBean("sampleManager");
>>> sampleManager.secureMethod1();
>>>
>>> So I write 2 spring remote beans
>>> first makes login and return jsessionId.
>>> <bean name="/login"
>>> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
>>> <property name="service" ref="loginManager"/>
>>> <property name="serviceInterface"
>>> value="com.springbook.LoginManagerRemote"/>
>>> </bean>
>>>
>>> second is secure bean
>>>
>>> <bean name="/sampleManager"
>>> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
>>> <property name="service" ref="sampleManager"/>
>>> <property name="serviceInterface"
>>> value="my.samples.shiro.spring.SampleManager"/>
>>> <property name="remoteInvocationExecutor"
>>> ref="secureRemoteInvocationExecutor"/>
>>> </bean>
>>>
>>> What should I do to call secure bean from my standalone client?
>>>
>>> If I just call it after login I get
>>>
>>> Exception in thread "main" java.lang.IllegalStateException: No
>>> SecurityManager accessible to the calling code, either bound to the
>>> org.apache.shiro.util.ThreadContext or as a vm static singleton. This is
>>> an
>>> invalid application configuration.
>>> at
>>> org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:115)
>>>
>>> --
>>> View this message in context:
>>> http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3910311.html
>>> Sent from the Shiro User mailing list archive at Nabble.com.
>>>
>>
>>
>
> --
> View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3914503.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Spring stand alone client
Posted by Narcom <na...@yahoo.com>.
I am not sure it is some kind of "issue". May be I do not understand smth. It
looks like on secure bean call it tries to get SecurityManager but cannot
find one because I did not inited one (but should I create one?)
If I create one as mentioned in Quickstart llike this
DefaultSecurityManager securityManager = new DefaultSecurityManager();
SecurityUtils.setSecurityManager( securityManager );
Subject subject = new
Subject.Builder().sessionId(user.getSessionId()).buildSubject();
ThreadState threadState = new SubjectThreadState(subject);
threadState.bind();
try {
SampleManager sampleManager = (SampleManager)
ctx.getBean("sampleManager");
//sampleManager.secureMethod1();
} finally {
threadState.clear();
}
I get this exception
org.apache.shiro.session.UnknownSessionException: There is no session with
id [f493926d-b5dc-4488-945e-1aa97145dc7a]
at
org.apache.shiro.session.mgt.eis.CachingSessionDAO.readSession(CachingSessionDAO.java:281)
at
org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSessionFromDataSource(DefaultSessionManager.java:202)
.....
at
org.apache.shiro.subject.Subject$Builder.buildSubject(Subject.java:703)
at com.springbook.client.RemotingTest.test(RemotingTest.java:67)
at com.springbook.client.RemotingTest.main(RemotingTest.java:36)
Should be SecurityManager inited automatically on Subject creation i.e.
Subject subject = new
Subject.Builder().sessionId(user.getSessionId()).buildSubject();
?
Les Hazlewood-2 wrote:
>
> Hi Narcom,
>
> Can you please re-post this along with the full stack trace (not just
> the SecurityUtils.getSecurityManager line) in a Jira issue? That way
> It won't get lost.
>
> - Les
>
> On Thu, Oct 29, 2009 at 3:48 AM, Narcom <na...@yahoo.com> wrote:
>>
>> I noticed that java web start GUI application does not start for “Apache
>> Shiro :: Samples :: Spring”.
>>
>> I use stand alone java program to access tomcat. Here its code
>>
>> PropertyConfigurator.configure("web/WEB-INF/log.properties");
>> ctx = new
>> FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
>> LoginManagerRemote loginManager = (LoginManagerRemote)
>> ctx.getBean("loginManager");
>> UserRemote user = loginManager.login();
>> log.info("user name: " + user.getName());
>> log.info("sesssionId: " + user.getSessionId());
>>
>> SampleManager sampleManager = (SampleManager)
>> ctx.getBean("sampleManager");
>> sampleManager.secureMethod1();
>>
>> So I write 2 spring remote beans
>> first makes login and return jsessionId.
>> <bean name="/login"
>> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
>> <property name="service" ref="loginManager"/>
>> <property name="serviceInterface"
>> value="com.springbook.LoginManagerRemote"/>
>> </bean>
>>
>> second is secure bean
>>
>> <bean name="/sampleManager"
>> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
>> <property name="service" ref="sampleManager"/>
>> <property name="serviceInterface"
>> value="my.samples.shiro.spring.SampleManager"/>
>> <property name="remoteInvocationExecutor"
>> ref="secureRemoteInvocationExecutor"/>
>> </bean>
>>
>> What should I do to call secure bean from my standalone client?
>>
>> If I just call it after login I get
>>
>> Exception in thread "main" java.lang.IllegalStateException: No
>> SecurityManager accessible to the calling code, either bound to the
>> org.apache.shiro.util.ThreadContext or as a vm static singleton. This is
>> an
>> invalid application configuration.
>> at
>> org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:115)
>>
>> --
>> View this message in context:
>> http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3910311.html
>> Sent from the Shiro User mailing list archive at Nabble.com.
>>
>
>
--
View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3914503.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Spring stand alone client
Posted by Les Hazlewood <lh...@apache.org>.
Hi Narcom,
Can you please re-post this along with the full stack trace (not just
the SecurityUtils.getSecurityManager line) in a Jira issue? That way
It won't get lost.
- Les
On Thu, Oct 29, 2009 at 3:48 AM, Narcom <na...@yahoo.com> wrote:
>
> I noticed that java web start GUI application does not start for “Apache
> Shiro :: Samples :: Spring”.
>
> I use stand alone java program to access tomcat. Here its code
>
> PropertyConfigurator.configure("web/WEB-INF/log.properties");
> ctx = new
> FileSystemXmlApplicationContext("/web/WEB-INF/remoting-client.xml");
> LoginManagerRemote loginManager = (LoginManagerRemote)
> ctx.getBean("loginManager");
> UserRemote user = loginManager.login();
> log.info("user name: " + user.getName());
> log.info("sesssionId: " + user.getSessionId());
>
> SampleManager sampleManager = (SampleManager) ctx.getBean("sampleManager");
> sampleManager.secureMethod1();
>
> So I write 2 spring remote beans
> first makes login and return jsessionId.
> <bean name="/login"
> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
> <property name="service" ref="loginManager"/>
> <property name="serviceInterface"
> value="com.springbook.LoginManagerRemote"/>
> </bean>
>
> second is secure bean
>
> <bean name="/sampleManager"
> class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter">
> <property name="service" ref="sampleManager"/>
> <property name="serviceInterface"
> value="my.samples.shiro.spring.SampleManager"/>
> <property name="remoteInvocationExecutor"
> ref="secureRemoteInvocationExecutor"/>
> </bean>
>
> What should I do to call secure bean from my standalone client?
>
> If I just call it after login I get
>
> Exception in thread "main" java.lang.IllegalStateException: No
> SecurityManager accessible to the calling code, either bound to the
> org.apache.shiro.util.ThreadContext or as a vm static singleton. This is an
> invalid application configuration.
> at
> org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:115)
>
> --
> View this message in context: http://n2.nabble.com/Spring-stand-alone-client-tp3910311p3910311.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>