Details
-
Type:
Bug
-
Status:
Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 1.0
-
Fix Version/s: 1.1
-
Labels:None
-
Testcase included:yes
Description
I had a look a the Shiro plugin and couldn't see anything wrong there (but I'm not a plugin/grails expert) and the problem looks like it lies within grails itself.
If you use a url mapping like this:
... "/$controller/$action?/$id?"{ constraints { // apply constraints here } } "404"(controller: 'error', action: 'notFound') ...
and use a url that doesn't exist so that the "/errors/notFound" view is used and that view uses <shiro:authenticated> then an exception occurs.
If you access the controller and it's action directly using a use a url like this: 'error/notFound' then everything works as expected.
Further to this, if you create a view which has this code:
<html>
<head>
<title>Not Found</title>
<meta name="layout" content="main" />
</head>
<body>
View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: ${org.apache.shiro.util.ThreadContext.getSecurityManager() == null }
</body>
</html>
The result will be "View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: true" when accessing a page that doesn't exist
and "View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: false" when accessing the controller and action directly.
Thus, any tag in the ShiroTagLib that uses SecurityManager.getSubject() will fail.
Attempting to use "<shiro:authenticated>Authenticated</shiro:authenticated>" in the "main" layout or the "notFound" view results in the following exception:
2009-10-15 12:06:49,899 [http-8080-3] ERROR errors.GrailsExceptionResolver - Error executing tag <shiro:authenticated>: java.lang.IllegalStateException: No SecurityManager accessible to this method, ... at Users_dclifton_Sites_shirobug_grails_app_views_layouts_main_gsp.run(Users_dclifton_Sites_shirobug_grails_app_views_layouts_main_gsp:27) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:646) at org.apache.catalina.core.ApplicationDispatcher.doInclude(ApplicationDispatcher.java:551) at org.apache.catalina.core.ApplicationDispatcher.include(ApplicationDispatcher.java:488) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:646) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:438) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:416) at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:343) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:144) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454) at java.lang.Thread.run(Thread.java:613) Caused by: org.codehaus.groovy.runtime.InvokerInvocationException: java.lang.IllegalStateException: No SecurityManager accessible to this method, ... ... 22 more Caused by: java.lang.IllegalStateException: No SecurityManager accessible to this method, ... at org.apache.shiro.SecurityUtils.getSubject(SecurityUtils.java:79) at ShiroTagLib.checkAuthenticated(ShiroTagLib.groovy:261) at ShiroTagLib.this$2$checkAuthenticated(ShiroTagLib.groovy) at ShiroTagLib$_closure1.doCall(ShiroTagLib.groovy:32) ... 22 more
I've attached an example project, two example urls that highlight the problem are:
http://localhost:8080/shirobug/i-dont-exist <-- throws exception
http://localhost:8080/shirobug/error/notFound <-- works as expected
Activity
| Field | Original Value | New Value |
|---|---|---|
| Project | Grails [ 11063 ] | Grails Plugins [ 11450 ] |
| Affects Version/s | 1.2-M2 [ 15425 ] | |
| Key | GRAILS-5234 | GRAILSPLUGINS-1980 |
| Component/s | Grails-Shiro [ 14023 ] | |
| Component/s | TagLib [ 12106 ] | |
| Affects Version/s | Grails-Shiro 1.0 [ 15545 ] |
| Assignee | Graeme Rocher [ graemerocher ] | Peter Ledbrook [ pledbrook ] |
| Fix Version/s | Grails-Shiro 1.1 [ 15888 ] |
| Description |
I had a look a the Shiro plugin and couldn't see anything wrong there (but I'm not a plugin/grails expert) and the problem looks like it lies within grails itself. If you use a url mapping like this: {code} ... "/$controller/$action?/$id?"{ constraints { // apply constraints here } } "404"(controller: 'error', action: 'notFound') ... {code} and use a url that doesn't exist so that the "/errors/notFound" view is used and that view uses <shiro:authenticated> then an exception occurs. If you access the controller and it's action directly using a use a url like this: 'error/notFound' then everything works as expected. Further to this, if you create a view which has this code: {code} <html> <head> <title>Not Found</title> <meta name="layout" content="main" /> </head> <body> View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: ${org.apache.shiro.util.ThreadContext.getSecurityManager() == null } </body> </html> {code} The result will be "View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: true" when accessing a page that doesn't exist and "View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: false" when accessing the controller and action directly. Thus, any tag in the ShiroTagLib that uses SecurityManager.getSubject() will fail. Attempting to use "<shiro:authenticated>Authenticated</shiro:authenticated>" in the "main" layout or the "notFound" view results in the following exception: {code} 2009-10-15 12:06:49,899 [http-8080-3] ERROR errors.GrailsExceptionResolver - Error executing tag <shiro:authenticated>: java.lang.IllegalStateException: No SecurityManager accessible to this method, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton. See the org.apache.shiro.SecurityUtils.getSubject() method JavaDoc for an explanation of expected environment configuration. org.codehaus.groovy.grails.web.taglib.exceptions.GrailsTagException: Error executing tag <shiro:authenticated>: java.lang.IllegalStateException: No SecurityManager accessible to this method, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton. See the org.apache.shiro.SecurityUtils.getSubject() method JavaDoc for an explanation of expected environment configuration. at Users_dclifton_Sites_shirobug_grails_app_views_layouts_main_gsp.run(Users_dclifton_Sites_shirobug_grails_app_views_layouts_main_gsp:27) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:646) at org.apache.catalina.core.ApplicationDispatcher.doInclude(ApplicationDispatcher.java:551) at org.apache.catalina.core.ApplicationDispatcher.include(ApplicationDispatcher.java:488) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:646) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:438) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:416) at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:343) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:144) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454) at java.lang.Thread.run(Thread.java:613) Caused by: org.codehaus.groovy.runtime.InvokerInvocationException: java.lang.IllegalStateException: No SecurityManager accessible to this method, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton. See the org.apache.shiro.SecurityUtils.getSubject() method JavaDoc for an explanation of expected environment configuration. ... 22 more Caused by: java.lang.IllegalStateException: No SecurityManager accessible to this method, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton. See the org.apache.shiro.SecurityUtils.getSubject() method JavaDoc for an explanation of expected environment configuration. at org.apache.shiro.SecurityUtils.getSubject(SecurityUtils.java:79) at ShiroTagLib.checkAuthenticated(ShiroTagLib.groovy:261) at ShiroTagLib.this$2$checkAuthenticated(ShiroTagLib.groovy) at ShiroTagLib$_closure1.doCall(ShiroTagLib.groovy:32) ... 22 more {code} I've attached an example project, two example urls that highlight the problem are: http://localhost:8080/shirobug/i-dont-exist <-- throws exception http://localhost:8080/shirobug/error/notFound <-- works as expected |
I had a look a the Shiro plugin and couldn't see anything wrong there (but I'm not a plugin/grails expert) and the problem looks like it lies within grails itself. If you use a url mapping like this: {code} ... "/$controller/$action?/$id?"{ constraints { // apply constraints here } } "404"(controller: 'error', action: 'notFound') ... {code} and use a url that doesn't exist so that the "/errors/notFound" view is used and that view uses <shiro:authenticated> then an exception occurs. If you access the controller and it's action directly using a use a url like this: 'error/notFound' then everything works as expected. Further to this, if you create a view which has this code: {code} <html> <head> <title>Not Found</title> <meta name="layout" content="main" /> </head> <body> View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: ${org.apache.shiro.util.ThreadContext.getSecurityManager() == null } </body> </html> {code} The result will be "View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: true" when accessing a page that doesn't exist and "View: org.apache.shiro.util.ThreadContext.getSecurityManager returns null?: false" when accessing the controller and action directly. Thus, any tag in the ShiroTagLib that uses SecurityManager.getSubject() will fail. Attempting to use "<shiro:authenticated>Authenticated</shiro:authenticated>" in the "main" layout or the "notFound" view results in the following exception: {code} 2009-10-15 12:06:49,899 [http-8080-3] ERROR errors.GrailsExceptionResolver - Error executing tag <shiro:authenticated>: java.lang.IllegalStateException: No SecurityManager accessible to this method, ... at Users_dclifton_Sites_shirobug_grails_app_views_layouts_main_gsp.run(Users_dclifton_Sites_shirobug_grails_app_views_layouts_main_gsp:27) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:646) at org.apache.catalina.core.ApplicationDispatcher.doInclude(ApplicationDispatcher.java:551) at org.apache.catalina.core.ApplicationDispatcher.include(ApplicationDispatcher.java:488) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:646) at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:438) at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:374) at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:302) at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:416) at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:343) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:144) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:849) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:454) at java.lang.Thread.run(Thread.java:613) Caused by: org.codehaus.groovy.runtime.InvokerInvocationException: java.lang.IllegalStateException: No SecurityManager accessible to this method, ... ... 22 more Caused by: java.lang.IllegalStateException: No SecurityManager accessible to this method, ... at org.apache.shiro.SecurityUtils.getSubject(SecurityUtils.java:79) at ShiroTagLib.checkAuthenticated(ShiroTagLib.groovy:261) at ShiroTagLib.this$2$checkAuthenticated(ShiroTagLib.groovy) at ShiroTagLib$_closure1.doCall(ShiroTagLib.groovy:32) ... 22 more {code} I've attached an example project, two example urls that highlight the problem are: http://localhost:8080/shirobug/i-dont-exist <-- throws exception http://localhost:8080/shirobug/error/notFound <-- works as expected |
| Attachment | GRAILSPLUGINS-1980-stacktrace.txt [ 47657 ] |
| Status | Open [ 1 ] | Resolved [ 5 ] |
| Resolution | Fixed [ 1 ] |
| Project Import | Thu Mar 24 21:55:00 CDT 2011 [ 1301021700396 ] |
| Fix Version/s | Grails-Shiro 1.1 [ 11180 ] | |
| Affects Version/s | Grails-Shiro 1.0 [ 11179 ] | |
| Affects Version/s | Grails-Shiro 1.0 [ 11869 ] | |
| Key | GRAILSPLUGINS-1980 |
|
| Project | Grails Plugins [ 10021 ] | Shiro Plugin [ 10217 ] |
| Component/s | Grails-Shiro [ 10563 ] | |
| Fix Version/s | Grails-Shiro 1.1 [ 11870 ] |
As a workaround, I updated my errorController to look like this:
Though why I have to do this remains a mystery to me, is this a grails bug or a shiro plugin bug?