[jira] [Commented] (SHIRO-411) Authentication not required for welcome-files in web.xml

["Les Hazlewood (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SHIRO-411?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13649220#comment-13649220 ] 

Les Hazlewood commented on SHIRO-411:
-------------------------------------

I suspect this is because you haven't told the servlet container to use the ShiroFilter to filter FORWARD dispatches as well:

http://shiro.apache.org/web.html#Web-Shiro1.2andlater

The ShiroFilter needs to execute to enforce [urls] filter chain definitions for all types of requests.

Alternatively, an easy fix is to remove the <welcome-file-list> and just create an index.jsp that contains the following:

{code}
<%@ page session="false" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%-- Redirect to login page --%>
<c:redirect url="protected/index.xhtml"/>
{code}
                
> Authentication not required for welcome-files in web.xml
> --------------------------------------------------------
>
>                 Key: SHIRO-411
>                 URL: https://issues.apache.org/jira/browse/SHIRO-411
>             Project: Shiro
>          Issue Type: Bug
>          Components: Authorization (access control) , Realms , Web
>    Affects Versions: 1.2.1
>         Environment: Win 7, Glassfish 3.1.2.2 or Tomcat 7
>            Reporter: Peter Bočák
>              Labels: cas
>
> Sample CAS server configuration as it was described in http://shiro.apache.org/cas.html (Complete configuration sample) doesn't require authentication for welcome files defined in web.xml.
> INI configuration [urls]:
>     /shiro-cas = casFilter
>     /protected/** = roles[ROLE_USER]
>     /** = anon
> web.xml:
>    <welcome-file-list>
>         <welcome-file>protected/index.xhtml</welcome-file>
>     </welcome-file-list>
> When I access URL localhost:8080/shiro-cas/protected/index.xhtml shiro correctly redirects me to CAS server for authentication.
> But if I access localhost:8080/shiro-cas/, application redirects me to specified welcome file /protected/index.xhtml without authentication.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira