Re: Using runAs() without session creation ?

[Mo Maison <mo...@yahoo.fr>]

Done :
https://issues.apache.org/jira/browse/SHIRO-420

Le 21/02/2013 03:29, Les Hazlewood a écrit :
> Hi Maison,
>
> This is a good question.  The basic idea however is that state
> information needs to be stored _somewhere_.
>
> Could you please open a feature request in Jira to make this part of
> Shiro pluggable?  I can envision a RunAsManager (or something similar)
> in the SecurityManager that can be consulted for runAs operations.
> Then you could plug in a persistence strategy, whether it be via the
> session or something else.
>
> Thanks,
>
> --
> Les Hazlewood | @lhazlewood
> CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
> Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk
>
> On Tue, Feb 19, 2013 at 1:53 AM, Maison Mo<mo...@yahoo.fr>  wrote:
>> Hello Shiro users,
>>
>> I am designing a stateless web application (no cookie at all), and have to use Subject.runAs() because subject complete identity is sometimes known lately (in application code rather than in shiro filters).
>> Problem : under the hood, DelegatingSubject.runAs() actually uses session, and calls createSession(true).
>>
>> I managed to avoid this by changing sm.subjectFactory, and overriding getSession(boolean) : basically I return a kind of HashMap wrapped as a fake org.apache.shiro.session.Session, hoping this object will not be persisted anywhere.
>> I'd prefer to avoid these kind of tricks....
>>
>> Just inquiring if it makes sense to runAs() without a backing storage allowing releaseRunAs() : the previous identity must be stored somewhere...
>> An alternative would be to use Subject.execute(), but this is not possible because I need to keep subject identity until after application code has returned (thus releaseRunAs() will never be called).
>>
>> Do you have any idea on this point ?
>>
>> Regards,
>>
>>   M. Maison
>>