Shiro-443 prevents custom Session Validation Scheduler?

[smm <st...@hcs.us.com>]

Hello All,

I decided to upgrade from Shiro 1.2.2 and 1.3.0.  I'm now seeing a problem
where I can't provide a custom SessionValidatorScheduler.  From my Shiro.ini
file:



As you can see, I've simplified things as much as possible for this test
case.  I'm trying to test some expiration problems I've been seeing, so I
set the Global Session Timeout to one minute (works) and I'm trying to set
the SessionValidationScheduler to one minute as well (so I don't have to
wait long for it to clean things out).

The problem I'm seeing with the setup above is that my
SessionValidationScheduler thread is never started.  I'm thinking this stems
from a code change in Shiro-443.

The first time this is called (when a browser requests the first session
since restart),
AbstractValidatingSessionManager.enableSessionValidationIfNecessary() is
called.  This method (shown below unchanged by Shiro-443) checks if the
scheduler == null (it doesn't, because I set it through the shiro.ini) and
checks scheduler.isEnabled() which is false so it calls
enableSessionValidation().



AbstractValidatingSessionManager.enableSessionValidation in 1.3.0 it looks
like:


while before Shiro-443 it looks like:

Since I set the scheduler through Shiro.ini, the scheduler is not null and
so the new code won't call scheduler.enableSessionValidation() which will
actually start the thread.  Hence the thread that actually does the work
will never start!

If I comment out my shiro.ini line:
sessionValidationScheduler.sessionManager = $sessionManager
Then, the scheduler is null, so the thread does start, but with the default
interval.

This seems like a bug introduced by Shiro-443, although I may be missing
something.

Thanks!

--Stephen




--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-443-prevents-custom-Session-Validation-Scheduler-tp7581185.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Shiro-443 prevents custom Session Validation Scheduler?

[smm <st...@hcs.us.com>]

Tried your fix and it worked. 

Also you're workaround using a custom interval and the default scheduler
worked with the old code.

Thanks for your help.

--Stephen



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-443-prevents-custom-Session-Validation-Scheduler-tp7581185p7581194.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Shiro-443 prevents custom Session Validation Scheduler?

[Brian Demers <br...@gmail.com>]

This was a regression introduced with SHIRO-443

I have proposed a fix:
https://github.com/apache/shiro/pull/34

Let us know how it goes.

Also, you can set the sessionValidationInterval with for the default
created scheduler via
`sessionManager.sessionValidationInterval = 6000`
but this will NOT be applied to a custom scheduler (which is your use case)

But for your last post something like the following should work, and not
create an NPE:

[main]
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager

# Set the timeout to one minute, so we don't have to wait so long
sessionDAO = org.apache.shiro.session.mgt.eis.MemorySessionDAO
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
sessionManager.globalSessionTimeout = 60000
sessionManager.sessionDAO = $sessionDAO
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.sessionValidationInterval = 6000


On Thu, Jul 28, 2016 at 3:32 PM, smm <st...@hcs.us.com> wrote:

> I should also point out that this problem prevents setting a custom
> securityManager.sessionManager.sessionValidationScheduler.interval .  For
> grins I tried this shiro.ini to see if I could work around the problem and
> get to the testing I set out to accomplish:
>
>
>
> Unfortunately, this fails with an NPE:
>
>
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Shiro-443-prevents-custom-Session-Validation-Scheduler-tp7581185p7581186.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: Shiro-443 prevents custom Session Validation Scheduler?

[smm <st...@hcs.us.com>]

I should also point out that this problem prevents setting a custom
securityManager.sessionManager.sessionValidationScheduler.interval .  For
grins I tried this shiro.ini to see if I could work around the problem and
get to the testing I set out to accomplish:



Unfortunately, this fails with an NPE:





--
View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-443-prevents-custom-Session-Validation-Scheduler-tp7581185p7581186.html
Sent from the Shiro User mailing list archive at Nabble.com.