Andrea Cosentino created CAMEL-26323:
----------------------------------------
Summary: camel-shiro: ShiroSecurityProcessor should authenticate
against policy security manager
Key: CAMEL-26323
URL: https://issues.apache.org/jira/browse/CAMEL-26323
Project: Camel
Issue Type: Bug
Components: camel-shiro
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0, 4.22.3, 4.18.6
h3. Current behaviour
In {{org.apache.camel.component.shiro.security.ShiroSecurityPolicy}}
({{camel-shiro}}), constructors loading configuration from INI register the
resulting {{SecurityManager}} in global static state via
{{SecurityUtils.setSecurityManager(securityManager)}}.
In
{{org.apache.camel.component.shiro.security.ShiroSecurityProcessor.process(...)}}:
{code:java}
Subject currentUser = SecurityUtils.getSubject();
{code}
The processor obtains the {{Subject}} from global thread-bound or static state
rather than building a subject associated directly with
{{policy.getSecurityManager()}}.
When multiple {{ShiroSecurityPolicy}} instances are configured in the same
application, each policy should authenticate and evaluate subjects against its
own configured {{SecurityManager}} without depending on or modifying global
static state.
h3. Expected behaviour
Each {{ShiroSecurityPolicy}} should manage its own {{SecurityManager}} instance
independently. {{ShiroSecurityProcessor}} should construct and authenticate the
{{Subject}} directly using the current route policy's {{SecurityManager}} (for
example via {{new
Subject.Builder(policy.getSecurityManager()).buildSubject()}}), and clear any
thread associations cleanly when processing completes.
h3. Change
* In {{ShiroSecurityPolicy}}:
- Avoid calling {{SecurityUtils.setSecurityManager(...)}} in policy
constructors.
* In {{ShiroSecurityProcessor}}:
- Build the {{Subject}} explicitly using {{policy.getSecurityManager()}}.
- Ensure authentication, authorization checks, and logout are scoped to that
explicit manager.
* Add unit tests in {{camel-shiro}} verifying multiple policies configured with
distinct managers operate independently.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
