On 08/11/2011 11:29 AM, manitas wrote: > Yes I think it would be great to have a small complete example containing > best practices for guice integration. > Sounds reasonable to me. https://issues.apache.org/jira/browse/SHIRO-320 > In fact my rest application works fine without shiro. Andit's not so easy to > add shiro and make it work. > > First of all I need the ServletContext to construct MyShiroWebModule. Where > do I get it ? > I have used this snippet found on this forum but I'm not sure this is the > best way to achieve that > ********************* > public class MyGuiceServletContextListener extends > GuiceServletContextListener { > private ServletContext servletContext; > > ....other stuff ... > > @Override > public void contextInitialized(ServletContextEvent servletContextEvent) > { > servletContext = servletContextEvent.getServletContext(); > super.contextInitialized(servletContextEvent); > } > } > ********************* This is currently the best way to do this. I recognize that this isn't ideal, so I'll try to explain the underlying issue.
Shiro has classes that are, by their nature, singletons. These classes require the injection of a ServletContext. guice-servlet does not support (or at least claims the functionality is deprecated) injecting a ServletContext on singleton objects. So, we have to provide that object to the singleton scope. I am certainly open for ideas to alleviate this issue in a cleaner manner. > Then, when I add the ShiroWebModule I have to add the following jars : > > guice-multibinding > org.apache.common.BeanUtils > org.apache.common.Logging > > I've not found those dependencies in the doc except for the > org.apache.common.BeanUtils which is normally "only" required if using INI > config. That's not my case. > By the way I'm not sure to understand why guice multibinding is needed > here. I can certainly add this dependency information to the docs. For what it's worth, this dependency information is all included properly in the maven configuration. However, since I understand that not everyone uses a dependency management tool, putting this info in an easy-to-read location seems reasonable. FYI, guice-multibinding is needed because shiro-guice uses it. Specifically, this is how it binds the realms. > and then when it's added, I get the following warning : > ****************************** > com.google.inject.servlet.InternalServletModule$BackwardsCompatibleServletContextProvider > get > ATTENTION: You are attempting to use a deprecated API (specifically, > attempting to @Inject ServletContext inside an eagerly created singleton. > While we allow this for backwards compatibility, be warned that this MAY > have unexpected behavior if you have more than one injector (with > ServletModule) running in the same JVM. Please consult the Guice > documentation at http://code.google.com/p/google-guice/wiki/Servlets for > more information. > ****************************** > > I've seen that you have already fixed this issue : > https://issues.apache.org/jira/browse/SHIRO-318 > > I'm not sure to understand why we do not use the regular way to add a filter > to guice : > filter("/*").through(org.apache.shiro.web.servlet.ShiroFilter.class); > instead of > ShiroWebModule.bindGuiceFilter(binder()); It's merely a convenience. Feel free to use the regular method. The proper code would be: filter("/*").through(org.apache.shiro.guice.web.GuiceShiroFilter.class); And note that this needs to go in a ServletModule, not the ShiroWebModule (since it's not a ServletModule). > That's why maybe a small example should help. > > Thanks in advance for your help. > > > > > > > -- > View this message in context: > http://shiro-user.582556.n2.nabble.com/Guice-shiro-jersey-tp6673315p6677020.html > Sent from the Shiro User mailing list archive at Nabble.com.
