shiro-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Laszlo Ferenczi (JIRA)" <>
Subject [jira] [Created] (SHIRO-435) SecurityManager is not a singleton in ShiroWebModule
Date Sat, 04 May 2013 20:44:16 GMT
Laszlo Ferenczi created SHIRO-435:

             Summary: SecurityManager is not a singleton in ShiroWebModule
                 Key: SHIRO-435
             Project: Shiro
          Issue Type: Bug
          Components: Integration: Guice
    Affects Versions: 1.2.1
            Reporter: Laszlo Ferenczi
            Assignee: Jared Bunting

While integrating Shiro to our guice based webapp I've noticed
something strange. The module setup is pretty much the same as the
example in the Guice page of Shiro's documentation. Only extra code is
that I'm exposing the WebSecurityManager like this:

public class AuthModule extends ShiroWebModule {

  public AuthModule(ServletContext servletContext) {

  protected void configureShiroWeb() {
    IniRealm iniRealm = new IniRealm(Ini.fromResourcePath("classpath:shiro.ini"));

A guice injected SecurityManager instance is not the same as the
cached static SecurityManager in SecurityUtils.

public class PingResource {
  SecurityManager sec;

  WebSecurityManager websec;

  public void ping() {
    SecurityManager man = SecurityUtils.getSecurityManager();

    assert(man == websec);
    assert(man == sec);

First assert passes, second fails. Debugger confirms that there are 2
instances in memory, both of them are of type
DefaultWebSecurityManager but only the WebSecurityManager instance
works. Any meaningful operation on "sec" will fail (like an
authorization check).

I think the problem might be the double binding of SecurityManager(s).
One is bound in ShiroModule another is in ShiroWebModule:

in ShiroModule:

public void configure() {
  // setup security manager

in ShiroWebModule:

protected final void configureShiro() {

Both of these methods are running at init time, hence the duplicated singletons.

It might be better if ShiroWebModule would overrinde the standard
configure() method to avoid this double-binding.

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see:

View raw message