You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Paweł Piątkowski <pi...@gmail.com> on 2012/07/13 14:42:02 UTC
Getting Spring session bean in servlet using WebApplicationContext
I'm trying to integrate my Spring application with the Apache Shiro.
I've done everything based on documentation (Integrating Apache Shiro into
Spring based Applications - http://shiro.apache.org/spring.html) and on
spring sample 1.2.0.
Everything seems to work fine including caching, realms, custom session's id
generators etc. but when it comes to use some spring session beans in a
servlet it simply doesn't work well.
The following example:
protected void doGet(HttpServletRequest request, HttpServletResponse
response) throws ServletException, IOException {
HttpSession session = request.getSession();
ServletContext sc = session.getServletContext();
WebApplicationContext appContext =
WebApplicationContextUtils.getWebApplicationContext(sc);
SampleSession sampleSession = (SampleSession)
appContext.getBean("sampleSession");
if (sampleSession.getUserName() != null) {
PrintWriter out = response.getWriter();
out.println(sampleSession.getUserName());
} else {
sampleSession.setUserName("lonestarr");
}
}
gives me white page after first request and "lonestarr" after second and...
till now it's ok but after third request I have the white page again :/
I've checked JSESSIONID cookie in my web browser. Every request has got
different JSESSIONIDs in request and response cookies.
When I switch securityManager to http sessionMode it works ok. Every request
has got its JSESSIONID in the request cookie only.
Is it possible to run it in native sessionMode?
-----
-----------------------
Paweł Piątkowski
http://pl.linkedin.com/in/ppiatkowski
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Getting-Spring-session-bean-in-servlet-using-WebApplicationContext-tp7577601.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Getting Spring session bean in servlet using
WebApplicationContext
Posted by Paweł Piątkowski <pi...@gmail.com>.
The configuration was ok. It is something connected with my Tomcat 6
configuration because it's working very well on JBoss AS 4.2.3 GA. When I
know what's going on I will describe it in this topic.
-----
-----------------------
Paweł Piątkowski
http://pl.linkedin.com/in/ppiatkowski
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Getting-Spring-session-bean-in-servlet-using-WebApplicationContext-tp7577601p7577613.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Getting Spring session bean in servlet using
WebApplicationContext
Posted by Paweł Piątkowski <pi...@gmail.com>.
Thank you for your reply Les.
Here is my web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
metadata-complete="true"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<resource-ref>
<description>DB Connection</description>
<res-ref-name>jdbc/SampleDB</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/root-context.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
<listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>controller</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/controller/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<description></description>
<display-name>ShiroServlet</display-name>
<servlet-name>ShiroServlet</servlet-name>
<servlet-class>samle.package.shiro.ShiroServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>ShiroServlet</servlet-name>
<url-pattern>/ShiroServlet</url-pattern>
</servlet-mapping>
<servlet>
<description></description>
<display-name>SpringSessionServlet</display-name>
<servlet-name>SpringSessionServlet</servlet-name>
<servlet-class>samle.package.shiro.SpringSessionServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>SpringSessionServlet</servlet-name>
<url-pattern>/SpringSessionServlet</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>controller</servlet-name>
<url-pattern>/controller/*</url-pattern>
</servlet-mapping>
<welcome-file-list>
<welcome-file>index.html</welcome-file>
</welcome-file-list>
</web-app>
and my root-context.xml is:
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:aop="http://www.springframework.org/schema/aop"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:jee="http://www.springframework.org/schema/jee"
xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/aop
http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-3.0.xsd
http://www.springframework.org/schema/jee
http://www.springframework.org/schema/jee/spring-jee-3.0.xsd
http://www.springframework.org/schema/tx
http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
<context:component-scan base-package="samle.package">
<context:exclude-filter
expression="org.springframework.stereotype.Controller"
type="annotation" />
</context:component-scan>
<bean id="sampleRealm" class="samle.package.shiro.sampleRealm" />
<bean id="sessionManager"
class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<property name="globalSessionTimeout" value="3000000"/>
</bean>
<bean id="securityManager"
class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="sessionMode" value="native"/>
<property name="sessionManager" ref="sessionManager" />
<property name="realm" ref="sampleRealm" />
</bean>
<bean id="lifecycleBeanPostProcessor"
class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<bean
class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
depends-on="lifecycleBeanPostProcessor" />
<bean
class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />
</bean>
<bean id="secureRemoteInvocationExecutor"
class="org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor">
<property name="securityManager" ref="securityManager" />
</bean>
<bean id="shiroFilter"
class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="http:/s/login/" />
<property name="successUrl" value="/s/index" />
<property name="unauthorizedUrl" value="/s/unauthorized" />
<property name="filterChainDefinitions">
<value>
/index.html = authc
</value>
</property>
</bean>
<bean class="samle.package.print.util.PrintHelper" />
<bean id="sampleSession" class="samle.package.session.SampleSession"
scope="session">
<aop:scoped-proxy />
</bean>
</beans>
I have solved my last problem by changing:
HttpSession session = request.getSession();
ServletContext sc = session.getServletContext();
WebApplicationContext appContext =
WebApplicationContextUtils.getWebApplicationContext(sc);
SampleSession sampleSession = (SampleSession)
appContext.getBean("sampleSession");
to:
ApplicationContext context =
WebApplicationContextUtils.getWebApplicationContext(getServletContext());
SampleSession sampleSession = (SampleSession)
context.getBean("sampleSession");
It works well with native and http session mode and there is only ony
JSESSIONID which is assosiated with
request and I have no cookies in response.
The problem appears again when I try to combine Shiro session with Spring
session bean in the same servlet.
Different JSESSIONID in response backs again and the following logs appear:
2012-07-16 12:19:09,739 TRACE
[org.apache.shiro.web.servlet.OncePerRequestFilter] - Filter 'ShiroFilter'
not yet executed. Executing now.
2012-07-16 12:19:09,745 TRACE [org.apache.shiro.mgt.DefaultSecurityManager]
- Context already contains a SecurityManager instance. Returning.
2012-07-16 12:19:09,745 DEBUG
[org.apache.shiro.session.mgt.AbstractValidatingSessionManager] - No
sessionValidationScheduler set. Attempting to create default instance.
2012-07-16 12:19:09,746 TRACE
[org.apache.shiro.session.mgt.AbstractValidatingSessionManager] - Created
default SessionValidationScheduler instance of type
[org.apache.shiro.session.mgt.ExecutorServiceSessionValidationScheduler].
2012-07-16 12:19:09,746 INFO
[org.apache.shiro.session.mgt.AbstractValidatingSessionManager] - Enabling
session validation scheduler...
2012-07-16 12:19:09,747 TRACE
[org.apache.shiro.session.mgt.AbstractValidatingSessionManager] - Attempting
to retrieve session with key
org.apache.shiro.web.session.mgt.WebSessionKey@8b7723e
2012-07-16 12:19:09,747 TRACE [org.apache.shiro.web.servlet.SimpleCookie] -
No 'JSESSIONID' cookie value
2012-07-16 12:19:09,747 DEBUG
[org.apache.shiro.session.mgt.DefaultSessionManager] - Unable to resolve
session ID from SessionKey
[org.apache.shiro.web.session.mgt.WebSessionKey@8b7723e]. Returning null to
indicate a session could not be found.
2012-07-16 12:19:09,747 TRACE [org.apache.shiro.mgt.DefaultSecurityManager]
- No identity (PrincipalCollection) found in the context. Looking for a
remembered identity.
2012-07-16 12:19:09,747 TRACE [org.apache.shiro.web.servlet.SimpleCookie] -
No 'rememberMe' cookie value
2012-07-16 12:19:09,747 TRACE [org.apache.shiro.mgt.DefaultSecurityManager]
- No remembered identity found. Returning original context.
2012-07-16 12:19:09,751 TRACE
[org.apache.shiro.subject.support.DelegatingSubject] - attempting to get
session; create = false; session is null = true; session has id = false
2012-07-16 12:19:09,751 TRACE
[org.apache.shiro.subject.support.DelegatingSubject] - attempting to get
session; create = false; session is null = true; session has id = false
2012-07-16 12:19:09,751 TRACE
[org.apache.shiro.subject.support.DelegatingSubject] - attempting to get
session; create = false; session is null = true; session has id = false
2012-07-16 12:19:09,754 TRACE
[org.apache.shiro.subject.support.DelegatingSubject] - attempting to get
session; create = false; session is null = true; session has id = false
2012-07-16 12:19:09,754 TRACE
[org.apache.shiro.web.servlet.AbstractShiroFilter] - No FilterChain
configured for the current request. Using the default.
Do you have any ideas?
-----
-----------------------
Paweł Piątkowski
http://pl.linkedin.com/in/ppiatkowski
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Getting-Spring-session-bean-in-servlet-using-WebApplicationContext-tp7577601p7577606.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Getting Spring session bean in servlet using WebApplicationContext
Posted by Les Hazlewood <lh...@apache.org>.
What does your Shiro configuration look like?
Also ensure that the ShiroFilter sits in front of any Spring filters.
If a Spring filter accesses a session before Shiro has the opportunity
to intercept the request, the Spring logic will trigger session
creation with the Servlet container outside of Shiro's control.
Cheers,
--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk
On Fri, Jul 13, 2012 at 5:42 AM, Paweł Piątkowski
<pi...@gmail.com> wrote:
> I'm trying to integrate my Spring application with the Apache Shiro.
>
> I've done everything based on documentation (Integrating Apache Shiro into
> Spring based Applications - http://shiro.apache.org/spring.html) and on
> spring sample 1.2.0.
>
> Everything seems to work fine including caching, realms, custom session's id
> generators etc. but when it comes to use some spring session beans in a
> servlet it simply doesn't work well.
>
> The following example:
>
> protected void doGet(HttpServletRequest request, HttpServletResponse
> response) throws ServletException, IOException {
> HttpSession session = request.getSession();
> ServletContext sc = session.getServletContext();
> WebApplicationContext appContext =
> WebApplicationContextUtils.getWebApplicationContext(sc);
> SampleSession sampleSession = (SampleSession)
> appContext.getBean("sampleSession");
> if (sampleSession.getUserName() != null) {
> PrintWriter out = response.getWriter();
> out.println(sampleSession.getUserName());
> } else {
> sampleSession.setUserName("lonestarr");
> }
> }
>
> gives me white page after first request and "lonestarr" after second and...
> till now it's ok but after third request I have the white page again :/
>
> I've checked JSESSIONID cookie in my web browser. Every request has got
> different JSESSIONIDs in request and response cookies.
>
> When I switch securityManager to http sessionMode it works ok. Every request
> has got its JSESSIONID in the request cookie only.
>
> Is it possible to run it in native sessionMode?
>
> -----
> -----------------------
> Paweł Piątkowski
> http://pl.linkedin.com/in/ppiatkowski
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Getting-Spring-session-bean-in-servlet-using-WebApplicationContext-tp7577601.html
> Sent from the Shiro User mailing list archive at Nabble.com.