Authentication Filter in Shiro with Spring + JSF

Question

i have some problem with Shiro authentication filter. I used spring framework (3.2) and JSF 2.2 in my project.

I've already done spring xml, web.xml, faces-config configuration file just like shiro official guide.

Here's my spring xml configuration (applicationContext.xml)

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager"/>
    <property name="loginUrl" value="/faces/login.xhtml"/>
    <property name="filterChainDefinitions">
        <value>
               /** = authc
        </value>
    </property>
</bean>
<bean id="propertyConfigurer"
      class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"
      p:location="/WEB-INF/jdbc.properties" />

<bean id="myRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
    <property name="dataSource" ref="dataSource"/>
    <property name="authenticationQuery" value="SELECT password FROM User WHERE nip = ?"/>
    <property name="userRolesQuery" value="SELECT role FROM User WHERE nip = ?"/>
    <property name="permissionsLookupEnabled" value="true" />
    <property name="permissionsQuery" value="SELECT action FROM role_action WHERE role = ?"/>

</bean>

<bean id="securityManager" class="org.apache.shiro.mgt.DefaultSecurityManager">
    <property name="realm" ref="myRealm"/>
</bean>

<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
    <property name="arguments" ref="securityManager"/>
</bean>

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManager"/>
</bean>

Here's my web.xml

<web-app>
<context-param>
    <param-name>javax.faces.PROJECT_STAGE</param-name>
    <param-value>Development</param-value>
</context-param>

<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

 <!--///////////////////////////SPRING SERVLET////////////////////////////////-->
<servlet>
    <servlet-name>appServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>appServlet</servlet-name>
    <url-pattern>/rest/*</url-pattern>
</servlet-mapping>


<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<session-config>
    <session-timeout>
        30
    </session-timeout>
</session-config>
<welcome-file-list>
    <welcome-file>faces/index.xhtml</welcome-file>
</welcome-file-list>

The problem is authentication filter not working as expected. I'm not get redirected to login.xhtml if i have not login. In that case i still can access any page without login.

Is there any problem with my config ? Or what should i do ? Thanks

Hi Sotirios Delimanolis, i've added my web.xml file. Please kindly check it out. Thanks — Aldo Suwandi

Aldo Suwandi Aldo Suwandi · Accepted Answer · 2013-12-12T04:49:05

I think i solved the problem, it because the securityManager bean. I have used wrong class, i used defaultsecuritymanager instead of defaultwebsecuritymanager.

Authentication Filter in Shiro with Spring + JSF

1 Answers