Package com.axelor.auth.pac4j

Class AxelorWebSecurityManager

java.lang.Object
org.apache.shiro.mgt.CachingSecurityManager
org.apache.shiro.mgt.RealmSecurityManager
org.apache.shiro.mgt.AuthenticatingSecurityManager
org.apache.shiro.mgt.AuthorizingSecurityManager
org.apache.shiro.mgt.SessionsSecurityManager
org.apache.shiro.mgt.DefaultSecurityManager
org.apache.shiro.web.mgt.DefaultWebSecurityManager
com.axelor.auth.pac4j.AxelorWebSecurityManager
All Implemented Interfaces:
org.apache.shiro.authc.Authenticator, org.apache.shiro.authz.Authorizer, org.apache.shiro.cache.CacheManagerAware, org.apache.shiro.event.EventBusAware, org.apache.shiro.lang.util.Destroyable, org.apache.shiro.mgt.SecurityManager, org.apache.shiro.session.mgt.SessionManager, org.apache.shiro.web.mgt.WebSecurityManager
@Singleton public class AxelorWebSecurityManager extends org.apache.shiro.web.mgt.DefaultWebSecurityManager
Web Security Manager

Since Shiro 2.2, a successful login stops the existing session and creates a new one to guard against session fixation. The attributes of the old session are copied to the new one.

This implementation adapts that behavior:

  • Session-less clients disable session creation for the request, so the attempt to recreate the session would throw DisabledSessionException once the old one is stopped. The session renewal is skipped for them, and AxelorWebSessionStorageEvaluator prevents their login from being stored in the existing session.
  • The CSRF token is not carried over to the renewed session, so that a token issued before authentication cannot be used afterwards. A new token is generated on the login response.

  • Field Summary

    Fields inherited from class org.apache.shiro.web.mgt.DefaultWebSecurityManager

    HTTP_SESSION_MODE, NATIVE_SESSION_MODE

    Fields inherited from class org.apache.shiro.mgt.DefaultSecurityManager

    rememberMeManager, subjectDAO, subjectFactory

  • Constructor Summary

    Constructors
    Constructor
    Description
    AxelorWebSecurityManager(Collection<org.apache.shiro.realm.Realm> realms, Set<org.apache.shiro.authc.AuthenticationListener> authenticationListeners, org.apache.shiro.authc.pam.ModularRealmAuthenticator authenticator, AxelorSessionManager sessionManager, AxelorWebSessionStorageEvaluator sessionStorageEvaluator, AxelorJCacheManager cacheManager)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    beforeSuccessfulLogin(org.apache.shiro.subject.Subject subject)
    Renews the existing session, unless session creation is disabled for the current request, and resets the CSRF token.

    Methods inherited from class org.apache.shiro.web.mgt.DefaultWebSecurityManager

    afterSessionManagerSet, beforeLogout, copy, createSessionContext, createSessionManager, createSubjectContext, getSessionKey, getSessionMode, isHttpSessionMode, removeRequestIdentity, setSessionManager, setSessionMode, setSubjectDAO

    Methods inherited from class org.apache.shiro.mgt.DefaultSecurityManager

    bind, createSubject, createSubject, delete, doCreateSubject, ensureSecurityManager, getRememberedIdentity, getRememberMeManager, getSubjectDAO, getSubjectFactory, login, logout, onFailedLogin, onSuccessfulLogin, rememberMeFailedLogin, rememberMeLogout, rememberMeSuccessfulLogin, resolveContextSession, resolvePrincipals, resolveSession, save, setRememberMeManager, setSubjectFactory, stopSession, unbind

    Methods inherited from class org.apache.shiro.mgt.SessionsSecurityManager

    afterCacheManagerSet, afterEventBusSet, applyCacheManagerToSessionManager, applyEventBusToSessionManager, destroy, getSession, getSessionManager, start

    Methods inherited from class org.apache.shiro.mgt.AuthorizingSecurityManager

    afterRealmsSet, checkPermission, checkPermission, checkPermissions, checkPermissions, checkRole, checkRoles, checkRoles, getAuthorizer, hasAllRoles, hasRole, hasRoles, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, setAuthorizer

    Methods inherited from class org.apache.shiro.mgt.AuthenticatingSecurityManager

    authenticate, getAuthenticator, setAuthenticator

    Methods inherited from class org.apache.shiro.mgt.RealmSecurityManager

    applyCacheManagerToRealms, applyEventBusToRealms, getRealms, setRealm, setRealms

    Methods inherited from class org.apache.shiro.mgt.CachingSecurityManager

    applyEventBusToCacheManager, getCacheManager, getEventBus, setCacheManager, setEventBus

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.apache.shiro.authc.Authenticator

    authenticate

    Methods inherited from interface org.apache.shiro.authz.Authorizer

    checkPermission, checkPermission, checkPermissions, checkPermissions, checkRole, checkRoles, checkRoles, hasAllRoles, hasRole, hasRoles, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll

    Methods inherited from interface org.apache.shiro.mgt.SecurityManager

    createSubject, login, logout

    Methods inherited from interface org.apache.shiro.session.mgt.SessionManager

    getSession, start

  • Constructor Details

  • Method Details

    • beforeSuccessfulLogin

      protected void beforeSuccessfulLogin(org.apache.shiro.subject.Subject subject)
      Renews the existing session, unless session creation is disabled for the current request, and resets the CSRF token.
      Overrides:
      beforeSuccessfulLogin in class org.apache.shiro.web.mgt.DefaultWebSecurityManager
      Parameters:
      subject - the subject about to be logged in