Shiro + Spring Caching Issue

[Philipp <ph...@gmail.com>]

We are currently working on a Web Application which integrates Wicket, 
Spring and Shiro. I would like to enable Shiro for using our ehCache. In 
our SpringConfig I define the following beans:

The first one is the definition of our Realm. It extends 
AuthorizingRealm and thus should support caching according to the Shiro 
documentation.

     @Bean
     public W7Realm W7Realm() {
         W7Realm realm = new W7Realm();
         HashedCredentialsMatcher credentialsMatcher = new 
HashedCredentialsMatcher(ShiroPasswordUtil.ALGORITHM);
         credentialsMatcher.setHashIterations(ShiroPasswordUtil.ITERATIONS);
         realm.setCredentialsMatcher(credentialsMatcher);
         return realm;
     }

Next, I define our login cache, which should cache the user credentials:

     @Bean(name="loginCache")
     public CacheManager shiroCacheManager() {
         EhCacheManager shiroCache = new EhCacheManager();
         shiroCache.setCacheManager(ehcache().getObject());
         return shiroCache;
     }

Thereby, the ehcache() call refers to our regular ehcache, which is also 
defined in the SpringConfig by:

     @Bean(name = "cacheManager")
     public EhCacheManagerFactoryBean ehcache() {
         EhCacheManagerFactoryBean mfb = new EhCacheManagerFactoryBean();
         mfb.setConfigLocation(new ClassPathResource("ehcache.xml"));
         return mfb;
     }

Finally, I am setting our security manager

     @Bean(name = "securityManager")
     public DefaultWebSecurityManager securityManager() {
         DefaultWebSecurityManager sm = new DefaultWebSecurityManager();
         sm.setCacheManager(shiroCacheManager());
         sm.setSessionMode(DefaultWebSecurityManager.HTTP_SESSION_MODE);
         sm.setRealm(W7Realm());
         // Set a servletcontainer session manager
         SessionManager session = new ServletContainerSessionManager();
         sm.setSessionManager(session);
         SecurityUtils.setSecurityManager(sm);
         return sm;
     }


However, Shiro does not use the cache manager which I set with the call

    sm.setCacheManager(shiroCacheManager());

Additionally, we tried to set the cache manager directly on the realm, 
but that did help either.

I am somewhat stuck here and any help would be greatly appreciated.

Re: Shiro + Spring Caching Issue

[Les Hazlewood <lh...@apache.org>]

Hi Philipp,

I'm not sure when 1.2 will be released - hopefully the team can get a
quorum and agree to release it within a month or so (there is some
cleanup work still to be done represented in Jira).

Any breaking changes would be noted discriminately in the
RELEASE-NOTES file at the root of the project:

http://svn.apache.org/repos/asf/shiro/trunk/RELEASE-NOTES

I've got a current backwards-incompatible change that is yet to be
committed, but it is a lower-level infrastructural thing that
shouldn't affect framework integration (like Wicket-Shiro) at all.

HTH,

-- 
Les Hazlewood
CTO, Katasoft | http://www.katasoft.com | 888.391.5282
twitter: http://twitter.com/lhazlewood
katasoft blog: http://www.katasoft.com/blogs/lhazlewood
personal blog: http://leshazlewood.com

Re: Shiro + Spring Caching Issue

[Philipp <ph...@gmail.com>]

Hi Les,

Thank your for your quick answer - I applied your suggested changes and 
used the debugger. The CacheManager is correctly applied to the realm 
and works fine.

However, the misconception was on my side. I thought that the caching is 
used for authentication too (but it isn't in 1.1 according to your last 
post).

My two remaining questions are

- Do you already know when Shiro 1.2 will be released?

- Will there be any breaking changes in Shiro 1.2 which would make the 
integration in third party frameworks such as Wicket-Shiro difficult?

Philipp

> In your current config, there is no need to set the session mode or
> the ServletContainerSessionManager - those two are already Shiro's
> default settings.
>
> In the securityManager() method, after you've set the realm, then call
> sm.setCacheManager(shiroCacheManager()) and that should work fine.
>
> If you connect a debugger, can you see that the CacheManager has been
> propagated to the realm?
>
> Cheers,
>
> Les
>
> P.S. Authorization Caching is available in 1.1.  Authentication
> Caching is available in trunk now and will be generally available in
> Shiro 1.2

Re: Shiro + Spring Caching Issue

[Les Hazlewood <lh...@apache.org>]

In your current config, there is no need to set the session mode or
the ServletContainerSessionManager - those two are already Shiro's
default settings.

In the securityManager() method, after you've set the realm, then call
sm.setCacheManager(shiroCacheManager()) and that should work fine.

If you connect a debugger, can you see that the CacheManager has been
propagated to the realm?

Cheers,

Les

P.S. Authorization Caching is available in 1.1.  Authentication
Caching is available in trunk now and will be generally available in
Shiro 1.2