oscerd commented on PR #28522:
URL: https://github.com/apache/camel/pull/28522#issuecomment-6437469847
Thanks @davsclaus for the detailed review! I have addressed all your points
in the latest commit:
1. **Orphaned sessions on alternating policies (`cleanUpManagedSubject`)**:
`ShiroSecurityProcessor` now tracks managed subjects and their
originating exchange under `MANAGED_SUBJECT` and `MANAGED_EXCHANGE` keys in
`ThreadContext`. When alternating policies execute on shared worker threads
with `alwaysReauthenticate=false`, any managed subject from a previous exchange
is logged out via `oldSubject.logout()` before creating and binding the new
subject, stopping in-memory session accumulation.
2. **Thread state restoration (`SubjectThreadState`)**:
Switched to `SubjectThreadState` to capture and restore the thread's
prior context resources (`threadState.restore()`) on reauthentication and
failure paths. Outer subjects (such as caller routes or web filter subjects)
are preserved rather than cleared. Added
`testNestedRouteSubjectThreadStateRestoration` in
`ShiroMultiplePolicyIsolationTest` to verify that an outer route's subject
remains intact after calling an inner route governed by a different policy.
3. **Upgrade guide updates**:
Updated `camel-4x-upgrade-guide-4_24.adoc` to include:
- Note about `UnavailableSecurityManagerException` when
`SecurityUtils.getSubject()` / `getSecurityManager()` is called outside the
policy, and how to configure `SecurityUtils.setSecurityManager(...)` at startup
if needed.
- Requirement to call `setSecurityManager(...)` when using the no-arg
constructor.
- Clarification that with `alwaysReauthenticate=true`, no subject remains
bound after the policy check completes.
4. **Backports consideration**:
Agreed — for the LTS branches (4.18.x / 4.22.x), keeping
`setSecurityManager` in the `ShiroSecurityPolicy` constructor and backporting
only the `ShiroSecurityProcessor` changes is a safer approach that prevents
breaking code relying on global manager visibility while still fixing realm
crosstalk.
5. **Test cleanups & authorization coverage**:
- Added `@AfterEach` in `ShiroMultiplePolicyIsolationTest` calling
`ThreadContext.remove()` to prevent subject leakage across test classes in the
fork.
- Added `testRoleAuthorizationIsolation` verifying that roles from realm
A fail authorization against policy B.
_Claude Code on behalf of oscerd_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
