You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by chucks <de...@gmail.com> on 2011/06/21 13:23:28 UTC
Newbie question on Shiro
I just started on Shiro to test integration with Spring (I am not an expert
on either). For ease I generated the Pizza application using Spring Roo
provided at
http://static.springsource.org/spring-roo/reference/html/beginning.html. I
did all steps except the security setup. So I have this Spring app running
with no security installed. Next I followed your documentation and decided
to start with IniRealm.
I added "shiroFilter" to web.xml and following to applicationContext.xml:
<bean id="lifecycleBeanPostProcessor"
class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<bean id="securityManager"
class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="iniRealm"/>
</bean>
<bean name="iniRealm" class="org.apache.shiro.realm.text.IniRealm">
<constructor-arg type="java.lang.String"
value="classpath:shiro.ini"/>
</bean>
<bean id="shiroFilter"
class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login"/>
<property name="successUrl" value="/index"/>
<property name="unauthorizedUrl" value="/login?login_error=t"/>
<property name="filterChainDefinitions">
<value>
/pizzas/** = authc, roles[ROLE_ADMIN]
/toppings/** = authc, roles[ROLE_ADMIN]
/bases/** = authc, roles[ROLE_ADMIN]
/resources/** = anon
/static/** = anon
/** = anon
</value>
</property>
</bean>
I also updated the POM with Shiro Core & Spring JAR dependencies. I have the
following in shiro.ini file kept under src/main/resources.
[main]
[users]
admin = admin, ROLE_ADMIN
[roles]
ROLE_ADMIN = *
[urls]
Next I added a login.jspx with two text fields username & password and a
checkbox rememberme. The form submits on to itself when we press "Submit".
The application works fine with the changes so far, for the protected URLs I
am taken to the "Login" page. However, when I submit the form the page just
reloads with empty fields and nothing happens, no stack trace nothing. I
assumed that Shiro's FormAuthenticationFilter will probably take care of the
authentication part based on credentials provided in ini file.
Please help me by telling what am I doing wrong.
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6499510.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Newbie question on Shiro
Posted by Jared Bunting <ja...@digitalreasoning.com>.
Just read my response and realized that I didn't explain the problem
very well. I also misread your message, so ignore most of my last response.
When using container-backed sessions, subject.logout() will invalidate
the current session (this is a good thing, you don't want it reused).
However, you won't get a new session from the server (jetty, tomcat,
whatever) until you submit a new request.
So, if your logout page, after invalidating the current session,
attempts to display some sort of information that it pulls from the
session, it's going to throw this exception. My best advice here is,
don't. Remove that information from the logout page.
On 06/21/2011 09:22 AM, Jared Bunting wrote:
> I can't answer definitively without seeing source and stacktrace, but my
> suspicion is that you're using container sessions, and on the same page
> you're attempting to get a session-bound attribute.
>
> Is this code intended to logout the user whenever they access the login
> page? I would suggest instead having an explicit logout url that
> performs the logout and then redirects to the login page. Or, at the
> very least, in your if statement there, doing a redirect to login rather
> than continuing to render the page (not sure if that's
> possible...haven't messed with jsp in awhile).
>
> On 06/21/2011 09:13 AM, pranay wrote:
>> Thanks again Jared.
>>
>> If you or someone else knows the answer to the problem mentioned at
>> http://shiro-user.582556.n2.nabble.com/help-when-I-login-secord-throws-getAttribute-Session-already-invalidated-td6233721.html
>> please do help.
>>
>> I am facing the same issue when calling the following logic in my
>> logout.jspx (error thrown is: java.lang.IllegalStateException: getAttribute:
>> Session already invalidated). Same error is thrown if I call
>> Subject.isAuthenticated(). It seems Shiro is not setting some expected
>> session attribute.
>>
>> <c:if test="${pageContext['request'].userPrincipal != null}">
>> <jsp:scriptlet>
>> SecurityUtils.getSubject().logout();
>> </jsp:scriptlet>
>> <util:panel id="title" title="Good Bye!">
>> <div>You were successfully logged out.</div>
>> </util:panel>
>> </c:if>
>>
>> --
>> View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6500149.html
>> Sent from the Shiro User mailing list archive at Nabble.com.
Re: Newbie question on Shiro
Posted by Jared Bunting <ja...@digitalreasoning.com>.
I can't answer definitively without seeing source and stacktrace, but my
suspicion is that you're using container sessions, and on the same page
you're attempting to get a session-bound attribute.
Is this code intended to logout the user whenever they access the login
page? I would suggest instead having an explicit logout url that
performs the logout and then redirects to the login page. Or, at the
very least, in your if statement there, doing a redirect to login rather
than continuing to render the page (not sure if that's
possible...haven't messed with jsp in awhile).
On 06/21/2011 09:13 AM, pranay wrote:
> Thanks again Jared.
>
> If you or someone else knows the answer to the problem mentioned at
> http://shiro-user.582556.n2.nabble.com/help-when-I-login-secord-throws-getAttribute-Session-already-invalidated-td6233721.html
> please do help.
>
> I am facing the same issue when calling the following logic in my
> logout.jspx (error thrown is: java.lang.IllegalStateException: getAttribute:
> Session already invalidated). Same error is thrown if I call
> Subject.isAuthenticated(). It seems Shiro is not setting some expected
> session attribute.
>
> <c:if test="${pageContext['request'].userPrincipal != null}">
> <jsp:scriptlet>
> SecurityUtils.getSubject().logout();
> </jsp:scriptlet>
> <util:panel id="title" title="Good Bye!">
> <div>You were successfully logged out.</div>
> </util:panel>
> </c:if>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6500149.html
> Sent from the Shiro User mailing list archive at Nabble.com.
Re: Newbie question on Shiro
Posted by pranay <de...@gmail.com>.
Thanks again Jared.
If you or someone else knows the answer to the problem mentioned at
http://shiro-user.582556.n2.nabble.com/help-when-I-login-secord-throws-getAttribute-Session-already-invalidated-td6233721.html
please do help.
I am facing the same issue when calling the following logic in my
logout.jspx (error thrown is: java.lang.IllegalStateException: getAttribute:
Session already invalidated). Same error is thrown if I call
Subject.isAuthenticated(). It seems Shiro is not setting some expected
session attribute.
<c:if test="${pageContext['request'].userPrincipal != null}">
<jsp:scriptlet>
SecurityUtils.getSubject().logout();
</jsp:scriptlet>
<util:panel id="title" title="Good Bye!">
<div>You were successfully logged out.</div>
</util:panel>
</c:if>
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6500149.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Newbie question on Shiro
Posted by Jared Bunting <ja...@digitalreasoning.com>.
On 06/21/2011 08:11 AM, pranay wrote:
> Thanks for the excellent hint Jared, I should have figured that out. It
> worked after I added the filter for login as you suggested. Now I am playing
> with the Shiro Taglib to hide/show the sidebar menu items. A funny think I
> noticed was the absence of the logout functionality OOTB.
I believe that OOTB logout functionality has been added in trunk (as a
filter).
> Since this roo generated application uses Hypersoninc in memory database I
> am next going to try authentication against database. Any helpful tutorial
> for that?
Not a tutorial, but I would start by looking at the JDBC realm. It
authenticates and authorizes against a very simple DB schema, but
modifying it to work with your app's schema should be fairly trivial.
Take a look at the set*Query methods - you might even be able to get by
w/o writing your own realm and just setting those properties.
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6499922.html
> Sent from the Shiro User mailing list archive at Nabble.com.
Re: Newbie question on Shiro
Posted by pranay <de...@gmail.com>.
Thanks for the excellent hint Jared, I should have figured that out. It
worked after I added the filter for login as you suggested. Now I am playing
with the Shiro Taglib to hide/show the sidebar menu items. A funny think I
noticed was the absence of the logout functionality OOTB.
Since this roo generated application uses Hypersoninc in memory database I
am next going to try authentication against database. Any helpful tutorial
for that?
--
View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6499922.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: Newbie question on Shiro
Posted by Jared Bunting <ja...@digitalreasoning.com>.
On 06/21/2011 06:23 AM, chucks wrote:
> I just started on Shiro to test integration with Spring (I am not an expert
> on either). For ease I generated the Pizza application using Spring Roo
> provided at
> http://static.springsource.org/spring-roo/reference/html/beginning.html. I
> did all steps except the security setup. So I have this Spring app running
> with no security installed. Next I followed your documentation and decided
> to start with IniRealm.
>
> I added "shiroFilter" to web.xml and following to applicationContext.xml:
>
> <bean id="lifecycleBeanPostProcessor"
> class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
> <bean id="securityManager"
> class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
> <property name="realm" ref="iniRealm"/>
> </bean>
> <bean name="iniRealm" class="org.apache.shiro.realm.text.IniRealm">
> <constructor-arg type="java.lang.String"
> value="classpath:shiro.ini"/>
> </bean>
> <bean id="shiroFilter"
> class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
> <property name="securityManager" ref="securityManager"/>
> <property name="loginUrl" value="/login"/>
Will this url take you to the login.jspx? If not, you should change it
to the appropriate value.
> <property name="successUrl" value="/index"/>
> <property name="unauthorizedUrl" value="/login?login_error=t"/>
>
> <property name="filterChainDefinitions">
> <value>
> /pizzas/** = authc, roles[ROLE_ADMIN]
> /toppings/** = authc, roles[ROLE_ADMIN]
> /bases/** = authc, roles[ROLE_ADMIN]
> /resources/** = anon
> /static/** = anon
> /** = anon
So, it looks to me like login.jspx is going to match this last filter.
This means that the FormAuthenticationFilter will never get called for
that url. Try adding (before this last chain), "/login = authc".
> </value>
> </property>
> </bean>
>
> I also updated the POM with Shiro Core & Spring JAR dependencies. I have the
> following in shiro.ini file kept under src/main/resources.
>
> [main]
>
> [users]
> admin = admin, ROLE_ADMIN
>
> [roles]
> ROLE_ADMIN = *
>
> [urls]
>
> Next I added a login.jspx with two text fields username & password and a
> checkbox rememberme. The form submits on to itself when we press "Submit".
> The application works fine with the changes so far, for the protected URLs I
> am taken to the "Login" page. However, when I submit the form the page just
> reloads with empty fields and nothing happens, no stack trace nothing. I
> assumed that Shiro's FormAuthenticationFilter will probably take care of the
> authentication part based on credentials provided in ini file.
>
> Please help me by telling what am I doing wrong.
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/Newbie-question-on-Shiro-tp6499510p6499510.html
> Sent from the Shiro User mailing list archive at Nabble.com.