You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Abid Hussain <hu...@gmx.de> on 2011/11/01 17:30:26 UTC
Question about SecurityUtils.getSubject()
Hi,
posted this message in the forum already but somehow hasn't been posted to the mailing list.
I'm new to Shiro and have a question about how SecurityUtils.getSubject() works.
After reading the documentation it's said that one simply retrieves the current user (subject) by calling
SecurityUtils.getSubject()
But in the context of multiple users concurrently using the application each with their own session how does SecurityUtils determine the relationship to the session? In this context I would rather expect something like
SecurityUtils.getSubject(session).
Any hints are appreciated...
Regards,
Abid
--
Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
Re: Question about SecurityUtils.getSubject()
Posted by sh...@xoxy.net.
Every request to the servlet container (except for the initial request)
contains a session ID (either as a cookie or URL parameter). The servlet
container tracks all active sessions and uses the session ID as a key to
retrieve the actual session object, which can then be bound to the current
thread via a ThreadLocal (this is effectively what Shiro does, though the
actual implementation is slightly different).
On Thu, Nov 3, 2011 at 11:38 AM, sshark - sshark@gmail.com wrote:
> Without going into the codes, I believe these filters are where the
> subject is set. At least this where I will begin to look for clues.
>
> org.apache.shiro.web.servlet.AbstractShiroFilter
> org.apache.shiro.web.servlet.IniShiroFilter
>
>
>
> On Thu, Nov 3, 2011 at 11:24 PM, Lenny Primak <lp...@hope.nyc.ny.us>wrote:
>
>> It does work. Ts a combination of a session, request and thread local.
>>
>>
>>
>> On Nov 3, 2011, at 9:11 AM, "Abid Hussain" <hu...@gmx.de> wrote:
>>
>> > Thanks! So this means the subject is retrieved from the current
>> thread... But this assumes that each user works in it's own thread. I
>> wonder how (or if) this works in a web application or more general in
>> applications where multiple users work on the same thread?
>> >
>> > Regards,
>> >
>> > Abid
>> >
>> >> It's all about your thread local request that keys in on the subject.
>> >>
>> >>
>> >>
>> >> On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de>
>> wrote:
>> >>
>> >>> Hi,
>> >>>
>> >>> posted this message in the forum already but somehow hasn't been
>> posted
>> >> to the mailing list.
>> >>>
>> >>> I'm new to Shiro and have a question about how
>> >> SecurityUtils.getSubject() works.
>> >>>
>> >>> After reading the documentation it's said that one simply retrieves
>> the
>> >> current user (subject) by calling
>> >>> SecurityUtils.getSubject()
>> >>>
>> >>> But in the context of multiple users concurrently using the
>> application
>> >> each with their own session how does SecurityUtils determine the
>> >> relationship to the session? In this context I would rather expect
>> something like
>> >>> SecurityUtils.getSubject(session).
>> >>>
>> >>> Any hints are appreciated...
>> >>>
>> >>> Regards,
>> >>>
>> >>> Abid
>> >>> --
>> >>> Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
>> >>> belohnen Sie mit bis zu 50,- Euro!
>> https://freundschaftswerbung.gmx.de
>> >>>
>> >
>> > --
>> > NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
>> > Jetzt informieren: http://www.gmx.net/de/go/freephone
>> >
>>
>
>
Re: Question about SecurityUtils.getSubject()
Posted by sshark <ss...@gmail.com>.
Without going into the codes, I believe these filters are where the subject
is set. At least this where I will begin to look for clues.
org.apache.shiro.web.servlet.AbstractShiroFilter
org.apache.shiro.web.servlet.IniShiroFilter
On Thu, Nov 3, 2011 at 11:24 PM, Lenny Primak <lp...@hope.nyc.ny.us>wrote:
> It does work. Ts a combination of a session, request and thread local.
>
>
>
> On Nov 3, 2011, at 9:11 AM, "Abid Hussain" <hu...@gmx.de> wrote:
>
> > Thanks! So this means the subject is retrieved from the current
> thread... But this assumes that each user works in it's own thread. I
> wonder how (or if) this works in a web application or more general in
> applications where multiple users work on the same thread?
> >
> > Regards,
> >
> > Abid
> >
> >> It's all about your thread local request that keys in on the subject.
> >>
> >>
> >>
> >> On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de>
> wrote:
> >>
> >>> Hi,
> >>>
> >>> posted this message in the forum already but somehow hasn't been posted
> >> to the mailing list.
> >>>
> >>> I'm new to Shiro and have a question about how
> >> SecurityUtils.getSubject() works.
> >>>
> >>> After reading the documentation it's said that one simply retrieves the
> >> current user (subject) by calling
> >>> SecurityUtils.getSubject()
> >>>
> >>> But in the context of multiple users concurrently using the application
> >> each with their own session how does SecurityUtils determine the
> >> relationship to the session? In this context I would rather expect
> something like
> >>> SecurityUtils.getSubject(session).
> >>>
> >>> Any hints are appreciated...
> >>>
> >>> Regards,
> >>>
> >>> Abid
> >>> --
> >>> Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
> >>> belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
> >>>
> >
> > --
> > NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
> > Jetzt informieren: http://www.gmx.net/de/go/freephone
> >
>
Re: Question about SecurityUtils.getSubject()
Posted by Lenny Primak <lp...@hope.nyc.ny.us>.
It does work. Ts a combination of a session, request and thread local.
On Nov 3, 2011, at 9:11 AM, "Abid Hussain" <hu...@gmx.de> wrote:
> Thanks! So this means the subject is retrieved from the current thread... But this assumes that each user works in it's own thread. I wonder how (or if) this works in a web application or more general in applications where multiple users work on the same thread?
>
> Regards,
>
> Abid
>
>> It's all about your thread local request that keys in on the subject.
>>
>>
>>
>> On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de> wrote:
>>
>>> Hi,
>>>
>>> posted this message in the forum already but somehow hasn't been posted
>> to the mailing list.
>>>
>>> I'm new to Shiro and have a question about how
>> SecurityUtils.getSubject() works.
>>>
>>> After reading the documentation it's said that one simply retrieves the
>> current user (subject) by calling
>>> SecurityUtils.getSubject()
>>>
>>> But in the context of multiple users concurrently using the application
>> each with their own session how does SecurityUtils determine the
>> relationship to the session? In this context I would rather expect something like
>>> SecurityUtils.getSubject(session).
>>>
>>> Any hints are appreciated...
>>>
>>> Regards,
>>>
>>> Abid
>>> --
>>> Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
>>> belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
>>>
>
> --
> NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
> Jetzt informieren: http://www.gmx.net/de/go/freephone
>
Re: Question about SecurityUtils.getSubject()
Posted by Abid Hussain <hu...@gmx.de>.
Thanks for quick reply. But still, how does Shiro now that a certain request comes from a certain user when calling SecurityUtils.getSubject() even if each request is handled by a new thread? There must be somewhere an assignment between request/session and user. So, I would be interested in how this is done?
Regards,
Abid
> Afaik, every http request (until response) that comes in is handled by a
> single thread
>
> On Thursday, November 3, 2011, Abid Hussain <hu...@gmx.de> wrote:
> > Thanks! So this means the subject is retrieved from the current
> thread...
> But this assumes that each user works in it's own thread. I wonder how (or
> if) this works in a web application or more general in applications where
> multiple users work on the same thread?
> >
> > Regards,
> >
> > Abid
> >
> >> It's all about your thread local request that keys in on the subject.
> >>
> >>
> >>
> >> On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de>
> wrote:
> >>
> >> > Hi,
> >> >
> >> > posted this message in the forum already but somehow hasn't been
> posted
> >> to the mailing list.
> >> >
> >> > I'm new to Shiro and have a question about how
> >> SecurityUtils.getSubject() works.
> >> >
> >> > After reading the documentation it's said that one simply retrieves
> the
> >> current user (subject) by calling
> >> > SecurityUtils.getSubject()
> >> >
> >> > But in the context of multiple users concurrently using the
> application
> >> each with their own session how does SecurityUtils determine the
> >> relationship to the session? In this context I would rather expect
> something like
> >> > SecurityUtils.getSubject(session).
> >> >
> >> > Any hints are appreciated...
> >> >
> >> > Regards,
> >> >
> >> > Abid
> >> > --
> >> > Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
> >> > belohnen Sie mit bis zu 50,- Euro!
> https://freundschaftswerbung.gmx.de
> >> >
> >
> > --
> > NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
> > Jetzt informieren: http://www.gmx.net/de/go/freephone
> >
--
NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
Jetzt informieren: http://www.gmx.net/de/go/freephone
Re: Question about SecurityUtils.getSubject()
Posted by sshark <ss...@gmail.com>.
Afaik, every http request (until response) that comes in is handled by a
single thread
On Thursday, November 3, 2011, Abid Hussain <hu...@gmx.de> wrote:
> Thanks! So this means the subject is retrieved from the current thread...
But this assumes that each user works in it's own thread. I wonder how (or
if) this works in a web application or more general in applications where
multiple users work on the same thread?
>
> Regards,
>
> Abid
>
>> It's all about your thread local request that keys in on the subject.
>>
>>
>>
>> On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de> wrote:
>>
>> > Hi,
>> >
>> > posted this message in the forum already but somehow hasn't been posted
>> to the mailing list.
>> >
>> > I'm new to Shiro and have a question about how
>> SecurityUtils.getSubject() works.
>> >
>> > After reading the documentation it's said that one simply retrieves the
>> current user (subject) by calling
>> > SecurityUtils.getSubject()
>> >
>> > But in the context of multiple users concurrently using the application
>> each with their own session how does SecurityUtils determine the
>> relationship to the session? In this context I would rather expect
something like
>> > SecurityUtils.getSubject(session).
>> >
>> > Any hints are appreciated...
>> >
>> > Regards,
>> >
>> > Abid
>> > --
>> > Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
>> > belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
>> >
>
> --
> NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
> Jetzt informieren: http://www.gmx.net/de/go/freephone
>
Re: Question about SecurityUtils.getSubject()
Posted by Abid Hussain <hu...@gmx.de>.
Thanks! So this means the subject is retrieved from the current thread... But this assumes that each user works in it's own thread. I wonder how (or if) this works in a web application or more general in applications where multiple users work on the same thread?
Regards,
Abid
> It's all about your thread local request that keys in on the subject.
>
>
>
> On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de> wrote:
>
> > Hi,
> >
> > posted this message in the forum already but somehow hasn't been posted
> to the mailing list.
> >
> > I'm new to Shiro and have a question about how
> SecurityUtils.getSubject() works.
> >
> > After reading the documentation it's said that one simply retrieves the
> current user (subject) by calling
> > SecurityUtils.getSubject()
> >
> > But in the context of multiple users concurrently using the application
> each with their own session how does SecurityUtils determine the
> relationship to the session? In this context I would rather expect something like
> > SecurityUtils.getSubject(session).
> >
> > Any hints are appreciated...
> >
> > Regards,
> >
> > Abid
> > --
> > Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
> > belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
> >
--
NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!
Jetzt informieren: http://www.gmx.net/de/go/freephone
Re: Question about SecurityUtils.getSubject()
Posted by Lenny Primak <lp...@hope.nyc.ny.us>.
It's all about your thread local request that keys in on the subject.
On Nov 1, 2011, at 12:30 PM, "Abid Hussain" <hu...@gmx.de> wrote:
> Hi,
>
> posted this message in the forum already but somehow hasn't been posted to the mailing list.
>
> I'm new to Shiro and have a question about how SecurityUtils.getSubject() works.
>
> After reading the documentation it's said that one simply retrieves the current user (subject) by calling
> SecurityUtils.getSubject()
>
> But in the context of multiple users concurrently using the application each with their own session how does SecurityUtils determine the relationship to the session? In this context I would rather expect something like
> SecurityUtils.getSubject(session).
>
> Any hints are appreciated...
>
> Regards,
>
> Abid
> --
> Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir
> belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de
>