apache shiro authorization annotations doesn't work with jsf 2.2

Question

I'm using apache shiro 1.2.4 with jsf 2.2 and glassfish 4.1 .

I'm using xhtml views not jsp here.

I have authentication working perfectly and I can require login before accessing pages, authorization works programmatically by using checkRole but not with annotations.

basically I want this:

@RequiresRoles("Administrator")
public static void addEmployee(Employee emp,String plaintextpassword)
{                
    PasswordGenerator.generatePassword(emp, plaintextpassword);
    new TransactionExecuter<Employee,Void>().execute(new ObjectAdder<Employee>(), emp);        
}

That is only admin can add employees.

I have added these jars with my netbeans 8.1 : aspectj-jrt, aspectj-weaver, asm , cglib, shiro-aspectj along with shiro-core and shiro-web ofcourse(all the latest version from maven repo).

I don't see any error related to this in my server log, I have hibernate.show_sql set to true yet I don't see the statement that should select employee role.

below is my Employee pojo:

@Entity
@Inheritance
public class Employee implements Serializable 
{
    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)    
    private Integer id;

    @Basic(optional=false)
    @Column(unique=true)
    private String username;

    @Basic(optional=false)
    private String passwordhash;

    @Basic(optional=false)
    private String passwordsalt;

    @Basic(optional=false)
    private String firstname;

    @Basic(optional=false)
    private String lastname;

    private String address;

    @Basic(optional=false)
    private Integer salary;

    private String phonenumber;                   

    //getters and setters and constructor
}

you can see the @Inheritance anotation , I have Administrator,DivisionManager,ManagementEmployee extending Employee with no extra fields or methods.

The Discriminator column is my Role name :) and As I said checkRole works :).

Last but not least here is my shiro.ini :

[main]
authc.loginUrl = /tmp/signin.xhtml
authc.successUrl = /tmp/employee_home.xhtml
logout.redirectUrl = /tmp/signin.xhtml

#Our Realm
jdbcRealm = com.model.realm.EmployeesRealm

# Sha256
sha256Matcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher
# base64 encoding, not hex in this example:
sha256Matcher.storedCredentialsHexEncoded = false
sha256Matcher.hashIterations = 1024

jdbcRealm.credentialsMatcher = $sha256Matcher

# User Query
# default is "select password from users where username = ?"
jdbcRealm.authenticationQuery = SELECT passwordhash, passwordsalt FROM Employee WHERE username = ?

# permissions
jdbcRealm.permissionsLookupEnabled = true
jdbcRealm.userRolesQuery = select DTYPE from Employee where username = ?
jdbcRealm.permissionsQuery = select permission from EmployeePermission perm inner join Employee_EmployeePermission empperm on perm.id=empperm.permissions_id inner join Employee emp on emp.id=empperm.Employee_id where username = ?

#database
ds = com.mysql.jdbc.jdbc2.optional.MysqlDataSource
ds.serverName = localhost
ds.user = root
ds.password = root
ds.databaseName = jsfdb
jdbcRealm.dataSource=$ds

authc.usernameParam = email
authc.passwordParam = password
authc.failureKeyAttribute = shiroLoginFailure

# Let's use some in-memory caching to reduce the number of runtime lookups against Stormpath.  A real
# application might want to use a more robust caching solution (e.g. ehcache or a distributed cache).  When using such
# caches, be aware of your cache TTL settings: too high a TTL and the cache won't reflect any potential
# changes in Stormpath fast enough.  Too low and the cache could evict too often, reducing performance.
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager

securityManager.realms = $jdbcRealm

[urls]
/* = authc
/tmp/signin.xhtml= anon

I only have web.xml and glassfish-resources.xml besides my shiro.ini, I'm saying this because there seems to be many config files which I don't know where to put.

Note1

I tried integrating spring but that failed not finding SpringBeanFacesELResolver So I thought of switching to AspectJ, I followed the sample project in their documentation and added the neccessary dependencies (with other files That I found in a stackoverflow answer).

I can work with checkRole but I want this to work :).

Note2

I verifed that the above mentioned jars(aspectj-jrt,etc) get deployed with the war, still doesn't work.

Dev Dev · Accepted Answer · 2016-05-25T03:46:07

For me its working. Are you using maven for build? For my case it was possible with maven as all required dependencies were there also then in compile it called aspectj compile which applied the annotations and the injection was working properly. Before that i also ran into trouble making it working. Try this https://github.com/apache/shiro/tree/master/samples/aspectj

If you are able to make it work it will aslo work for jsf

apache shiro authorization annotations doesn't work with jsf 2.2

Note1

Note2

1 Answers