为什么向@RequiresUser的请求没有重定向到登录页面？

设置如下：嵌入式Jetty 9.3.0.M0运行GuiceServlet 3.0，它反过来使用Jersey 1.18.1进行映射以及它可以执行的所有其他漂亮的事情。 Shiro 1.2.3被添加到此设置以提供安全性。在进行一般Shiro和ShiroWebModule中的filterChains的配置时，设置完美无瑕。为什么向@RequiresUser的请求没有重定向到登录页面？

当使用Shiro的AOP功能注释我的方法Shiro's annotations时，对注释方法的URL的请求不会被重定向到登录页面。相反，org.apache.shiro.authz.UnauthenticatedException异常由新泽西州的ContainerResponse抛出：

ERROR com.sun.jersey.spi.container.ContainerResponse - 
The RuntimeException could not be mapped to a response, 
re-throwing to the HTTP container 
org.apache.shiro.authz.UnauthenticatedException: Attempting to perform a user-only operation. 
The current Subject is not a user (they haven't been authenticated or remembered from a previous login). Access denied. 
at org.apache.shiro.authz.aop.UserAnnotationHandler.assertAuthorized(UserAnnotationHandler.java:61) 
at org.apache.shiro.authz.aop.AuthorizingAnnotationMethodInterceptor.assertAuthorized(AuthorizingAnnotationMethodInterceptor.java:84) 
at org.apache.shiro.authz.aop.AuthorizingAnnotationMethodInterceptor.invoke(AuthorizingAnnotationMethodInterceptor.java:67) 
at org.apache.shiro.guice.aop.AopAllianceMethodInterceptorAdapter.invoke(AopAllianceMethodInterceptorAdapter.java:36) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
at java.lang.reflect.Method.invoke(Method.java:606) 
at com.sun.jersey.spi.container.JavaMethodInvokerFactory$1.invoke(JavaMethodInvokerFactory.java:60) 
at com.sun.jersey.server.impl.model.method.dispatch.AbstractResourceMethodDispatchProvider$TypeOutInvoker._dispatch(AbstractResourceMethodDispatchProvider.java:185) 
at com.sun.jersey.server.impl.model.method.dispatch.ResourceJavaMethodDispatcher.dispatch(ResourceJavaMethodDispatcher.java:75) 
at com.sun.jersey.server.impl.uri.rules.HttpMethodRule.accept(HttpMethodRule.java:302) 
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) 
at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) 
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) 
at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) 
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) 
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) 
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) 
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) 
at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) 
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:540) 
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:715) 
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) 
at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:263) 
at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:178) 
at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:62) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:112) 
at com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58) 
at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449) 
at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365) 
at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90) 
at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83) 
at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383) 
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) 
at com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58) 
at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:118) 
at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:113) 
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650) 
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:583) 
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:221) 
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1126) 
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515) 
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185) 
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1060) 
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) 
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97) 
at org.eclipse.jetty.server.Server.handle(Server.java:498) 
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:265) 
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:243) 
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540) 
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:610) 
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:539) 
at java.lang.Thread.run(Thread.java:744) 
Caused by: org.apache.shiro.authz.AuthorizationException: Not authorized to invoke method: public java.lang.String org.example.product.ExampleApp.controller.Index.secured() 
at org.apache.shiro.authz.aop.AuthorizingAnnotationMethodInterceptor.assertAuthorized(AuthorizingAnnotationMethodInterceptor.java:90)

浏览器显示一个javax.servlet.ServletException: Filtered request failed.。

然而，根据新泽西州ExceptionMapper实现捆绑：

/* other imports omitted for readability */ 
import org.apache.shiro.authz.UnauthenticatedException; 

public class UnauthenticatedExceptionHandler 
       implements ExceptionMapper<UnauthenticatedException>{ 

    public Response toResponse(UnauthenticatedException exception) {  
    return Response.status(Status.FORBIDDEN).type(MediaType.TEXT_PLAIN) 
      .entity("Authorization required").build(); 
    } 
}

因此即使四郎不将请求重定向到登录页面，则ExceptionMapper应该触发，它没有。为NotFoundException等工作的绑定ExceptionMappers。

必要MethodInterceptors定义和约束的模块，其被安装在我的“主”模块中：

/* imports ommitted for readability */ 
public class ShiroMethodInterceptorModule extends AbstractModule { 

@Override 
protected void configure() { 
    bindInterceptor(Matchers.any(), Matchers.annotatedWith(RequiresRoles.class), 
      new ShiroMethodInterceptor(new RoleAnnotationMethodInterceptor())); 
    bindInterceptor(Matchers.any(), Matchers.annotatedWith(RequiresUser.class), 
      new ShiroMethodInterceptor(new UserAnnotationMethodInterceptor())); 
    bindInterceptor(Matchers.any(), Matchers.annotatedWith(RequiresPermissions.class), 
      new ShiroMethodInterceptor(new PermissionAnnotationMethodInterceptor())); 
    bindInterceptor(Matchers.any(), Matchers.annotatedWith(RequiresGuest.class), 
      new ShiroMethodInterceptor(new GuestAnnotationMethodInterceptor())); 
    bindInterceptor(Matchers.any(), Matchers.annotatedWith(RequiresAuthentication.class), 
      new ShiroMethodInterceptor(new AuthenticatedAnnotationMethodInterceptor())); 
    } 

}

ShiroMethodInterceptor（从@pabiagioli 's "shiro-guice-jersey-bootstrap" project无耻复制）的实施如下：

public class ShiroMethodInterceptor implements MethodInterceptor{ 

static final Logger logger = Logger.getLogger(ShiroMethodInterceptor.class.getName()); 

private org.apache.shiro.aop.MethodInterceptor methodInterceptor; 

public ShiroMethodInterceptor(org.apache.shiro.aop.MethodInterceptor methodInterceptor) { 
    this.methodInterceptor = methodInterceptor; 
} 


    public Object invoke(MethodInvocation methodInvocation) throws Throwable { 
    return methodInterceptor.invoke(new ShiroMethodInvocation(methodInvocation)); 
    } 

    private static class ShiroMethodInvocation implements org.apache.shiro.aop.MethodInvocation { 

    private final MethodInvocation methodInvocation; 

    public ShiroMethodInvocation(MethodInvocation methodInvocation) { 
     this.methodInvocation = methodInvocation; 
    } 

    public Object proceed() throws Throwable { 
     return methodInvocation.proceed(); 
    } 

    public Method getMethod() { 
     return methodInvocation.getMethod(); 
    } 

    public Object[] getArguments() { 
     return methodInvocation.getArguments(); 
    } 

    public Object getThis() { 
     return methodInvocation.getThis(); 
    } 
    } 
}

该项目是用Maven构建，并确定了相关的依赖关系是：

Jersey的吉斯1.18.1
- 吉斯3.0
- 吉斯-的servlet 3.0
- 球衣-的servlet 1.18.1
四郎核1.2.3
四郎的Web 1.2。 3
四郎-吉斯1.2.3
四郎-的AspectJ 1.2.3

编辑：为是完整的：境界是由根据提供者创建的ShiroWebModule的配置方法如下：

protected void configureShiroWeb() { 

    bindConstant().annotatedWith(Names.named("shiro.loginUrl")) 
      .to("/login"); 

    addFilterChain("/", ANON); 

    addFilterChain("/login", AUTHC); 
    addFilterChain("/logout", LOGOUT); 

    /* The following rule is activated when not using AOP 
    * annotations 
    * addFilterChain("/**", AUTHC); 
    */ 

}

我真的很感激任何指针。请不要犹豫，要求进一步的信息。

编辑2：这可能是不相关的，但为了完整性，我在此添加它。进一步调查此问题我注意到，即使我完全在ShiroWebModule中配置Shiro并完全禁用注释和AOP，但如果出现错误或空证书，就我可以看到运行时异常异常被抛出，这是由运动衫打包并打包变成WebApplicationException：

javax.ws.rs.WebApplicationException 
at com.sun.jersey.server.impl.uri.rules.TerminatingRule.accept(TerminatingRule.java:66) 
at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) 
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) 
at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) 
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) 
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) 
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) 
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) 
at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) 
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:540) 
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:715) 
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) 
at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:263) 
at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:178) 
at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:62) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:112) 
at com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58) 
at org.apache.shiro.guice.web.SimpleFilterChain.doFilter(SimpleFilterChain.java:44) 
at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) 
at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) 
at org.apache.shiro.guice.web.SimpleFilterChain.doFilter(SimpleFilterChain.java:41) 
at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449) 
at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365) 
at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90) 
at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83) 
at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383) 
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) 
at com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58) 
at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:118) 
at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:113) 
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650) 
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:583) 
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:221) 
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1126) 
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515) 
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185) 
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1060) 
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) 
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97) 
at org.eclipse.jetty.server.Server.handle(Server.java:498) 
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:265) 
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:243) 
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540) 
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:610) 
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:539) 
at java.lang.Thread.run(Thread.java:744) 

javax.ws.rs.WebApplicationException 
at com.sun.jersey.server.impl.uri.rules.TerminatingRule.accept(TerminatingRule.java:66) 
at com.sun.jersey.server.impl.uri.rules.ResourceClassRule.accept(ResourceClassRule.java:108) 
at com.sun.jersey.server.impl.uri.rules.RightHandPathRule.accept(RightHandPathRule.java:147) 
at com.sun.jersey.server.impl.uri.rules.RootResourceClassesRule.accept(RootResourceClassesRule.java:84) 
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1542) 
at com.sun.jersey.server.impl.application.WebApplicationImpl._handleRequest(WebApplicationImpl.java:1473) 
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1419) 
at com.sun.jersey.server.impl.application.WebApplicationImpl.handleRequest(WebApplicationImpl.java:1409) 
at com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:409) 
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:540) 
at com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:715) 
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790) 
at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:263) 
at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:178) 
at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:91) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:62) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:112) 
at com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58) 
at org.apache.shiro.guice.web.SimpleFilterChain.doFilter(SimpleFilterChain.java:44) 
at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) 
at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) 
at org.apache.shiro.guice.web.SimpleFilterChain.doFilter(SimpleFilterChain.java:41) 
at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449) 
at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365) 
at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90) 
at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83) 
at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:383) 
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362) 
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) 
at com.google.inject.servlet.FilterDefinition.doFilter(FilterDefinition.java:163) 
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:58) 
at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:118) 
at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:113) 
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1650) 
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:583) 
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:221) 
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1126) 
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515) 
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185) 
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1060) 
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) 
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97) 
at org.eclipse.jetty.server.Server.handle(Server.java:498) 
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:265) 
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:243) 
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:540) 
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:610) 
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:539) 
at java.lang.Thread.run(Thread.java:744)

来源

2014-11-01 Markus W Mahlberg

还未回答这个问题吗？ – Gideon 2018-01-15 09:54:12

这实际上是authc过滤器常见的错误。它需要配置为过滤所有的URL，否则它们不可用。试试这个：

addFilterChain("/logout", LOGOUT); 
addFilterChain("/**", AUTHC);

来源

2014-11-01 17:53:52 jbunting

非常感谢您的回答。我尝试了它，区别在于所有请求（甚至是用@ @ RequiresGuest注释的请求）都被重定向到了登录页面。不过，注释并没有被忽略，因为我尝试了'@ RequiresRoles'。但不是显示配置的'roles.unauthorizedUrl'（绑定为ShiroWebModule中的常量），而是抛出异常：'javax.servlet.ServletException：org.apache.shiro.authz.UnauthorizedException：主体没有角色[admin ]' - 虽然我有一个UnauthorizedExceptionMapper实现并绑定。我不确定这里发生了什么事。 – 2014-11-01 19:32:35

好吧，我的坏。除了通过ShiroWebModule安装的过滤器之外，我还通过GuiceShiroFilter过滤了所有内容。现在，RequiresGuest注释工作（将必须实现一个匿名注释;））。但是，针对非匹配授权的ServletExceptions仍然被抛出。 – 2014-11-01 19:48:04

基于注释的授权断言逻辑当前不是web感知的。你有两个选择：

配置你选择的web框架，以捕获异常，因为他们泡了和重定向如预期，或
使用四郎的Servlet过滤型的断言框架（如你似乎已经配置）。

为了使这是一个更加“开箱即用”的工作体验，需要修改Shiro servlet过滤器实现以捕获已知的Shiro异常，因为它们会起泡并将最终用户重定向到已知位置 - 请打开一个Jira问题来捕获这项工作。 HTH！

来源

2014-11-03 17:28:42

为什么向@RequiresUser的请求没有重定向到登录页面？

回答

相关问题