You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Ralph Scheuer <ra...@gmx.net> on 2014/01/08 10:41:16 UTC
Special anonymous user
Hello everybody,
we have an online shop where I need to replace the Spring Security stuff
with Apache Shiro.
We have certain areas where a registered user needs to be logged in
(checkout, account section, etc.) and an area where everybody is allowed to
access.
So far, everything is working except for one aspect: In Spring security, we
had a special user (anonymous customer) who is logged in automatically upon
visiting any non-restricted area of the shop. This user has various
properties and he can also place items in the shopping cart. After the login
of the registered user (for the checkout), the existing cart is merged with
a cart that may derive from a previous session and which has been saved for
this user in the database.
So my question is: how do I auto-login my anonymous customer so that this
object is available as a principal via SecurityUtils when no registered user
is remembered or logged in without really restricting anonymous access?
With spring security, my xml for the authentication manager looked somewhat
like this (the relevant section is in the security:user-service entity:
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider>
<security:user-service>
<security:user name="user" password="user"
authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
<security:authentication-provider
ref="customerAuthenticationProvider" />
<security:authentication-provider
ref="rememberMeAuthenticationProvider" />
</security:authentication-manager>
Thanks for your help.
Ralph
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Special-anonymous-user-tp7579492.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Special anonymous user
Posted by Tomas Lund Petersen <ko...@gmail.com>.
Hi ralf,
I have a basic understanding of shiro but if i were you i would justo use
the subject attached to the thread SecurityUtils.getSubject(); as tan
annonimous user until the user logs in and then Call Subject.logon(token);
Hope It helps,
Tomas
El 08/01/2014 06:41, "Ralph Scheuer" <ra...@gmx.net> escribió:
> Hello everybody,
>
> we have an online shop where I need to replace the Spring Security stuff
> with Apache Shiro.
>
> We have certain areas where a registered user needs to be logged in
> (checkout, account section, etc.) and an area where everybody is allowed to
> access.
>
> So far, everything is working except for one aspect: In Spring security, we
> had a special user (anonymous customer) who is logged in automatically upon
> visiting any non-restricted area of the shop. This user has various
> properties and he can also place items in the shopping cart. After the
> login
> of the registered user (for the checkout), the existing cart is merged with
> a cart that may derive from a previous session and which has been saved for
> this user in the database.
>
> So my question is: how do I auto-login my anonymous customer so that this
> object is available as a principal via SecurityUtils when no registered
> user
> is remembered or logged in without really restricting anonymous access?
>
> With spring security, my xml for the authentication manager looked somewhat
> like this (the relevant section is in the security:user-service entity:
>
> <security:authentication-manager alias="authenticationManager">
>
> <security:authentication-provider>
>
> <security:user-service>
>
> <security:user name="user" password="user"
> authorities="ROLE_USER" />
>
> </security:user-service>
>
> </security:authentication-provider>
>
> <security:authentication-provider
>
> ref="customerAuthenticationProvider" />
>
> <security:authentication-provider
>
> ref="rememberMeAuthenticationProvider" />
>
> </security:authentication-manager>
>
>
>
> Thanks for your help.
>
> Ralph
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Special-anonymous-user-tp7579492.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>
Re: Special anonymous user
Posted by Les Hazlewood <lh...@apache.org>.
Hi Ralph!
Welcome to the Shiro community :)
We have certain areas where a registered user needs to be logged in
> (checkout, account section, etc.) and an area where everybody is allowed to
> access.
>
> So far, everything is working except for one aspect: In Spring security, we
> had a special user (anonymous customer) who is logged in automatically
This is one thing I never understood in Spring Security (and still don't
since I don't use it - I'd love for someone more knowledgeable than me to
clarify how this actually works - or what this really means - in SS).
In the security world, there is no such thing as 'anonymous
authentication'. Authentication is the process of *proving* you are who
you say you are. If you're anonymous, then you're not proving anything,
and thus you're not authenticating anything.
upon
> visiting any non-restricted area of the shop. This user has various
> properties and he can also place items in the shopping cart. After the
> login
> of the registered user (for the checkout), the existing cart is merged with
> a cart that may derive from a previous session and which has been saved for
> this user in the database.
>
> So my question is: how do I auto-login my anonymous customer so that this
> object is available as a principal via SecurityUtils when no registered
> user
> is remembered or logged in without really restricting anonymous access?
>
This is where I'm drawing a blank - are you saying that, if the end-user is
anonymous, then they should have some data (shopping car) associated with
them via the Subject? And then after you know their identity (either via
remember me or via authentication) that the data is then anonymous-usage
shopping cart is merged with the known-user shopping cart?
If so, isn't this what sessions are for? Can you store the anonymous-usage
shopping cart in their session (subject.getSession()), and then after they
log in, retrieve what is currently in there and then merge it with what is
stored, and then put that back in the session?
For example:
ShoppingCart existingCart =
(ShoppingCart)subject.getSession().getAttribute("shoppingCart");
//login:
String username = //get username
String password = //get password
subject.login(new UsernamePasswordToken(username, password));
//identity is known, look up any saved cart:
long userId = (Long)subject.getPrincipal();
ShoppingCart savedCart = shoppingCartStore.findByUserId(userId);
savedCart.putAll(existingCart);
subject.getSession().setAttribute("shoppingCart", savedCart);
Or, are you saying that when you call SecurityUtils.getSubject(), you want
this subject to automatically be populated with specific principals before
they login?
I apologize - it is not too clear to me what you are asking - I could very
well be misinterpreting your question!
Best,
--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282