Shiro with Wicket on OSGi (PAX Wicket 2.1.1, Wicket 6.19.0, ServiceMix 4.5.3/5.4.0, Shiro 1.2.3)

[Harald]

Hi,

I just subscribed to ask for a little bit of help.

I'm already using Shiro to secure some Wicket applications. Now I need to do the same on OSGi (ServiceMix 4.5.3 and 5.4.0). I managed to get a wicket application running on OSGi using blueprint - but Shiro didn't kick in. First I thought it is a Shiro issue so I asked on the Shiro list without real success. I played around and managed to get to the point where the Wicket application got started but accessing the page lead to an exception telling me that the WebEnvironment does not exist. So I thought the only thing I need to figure out is the blueprint equivalent for

<listener>
  <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>

I had the idea to set a WebEnvironment from within the application but this failed because of a missing SecurityManager. So I created a SecurityManagerContainer class which holds a member var annotated as a PaxWicketBean with the name shiroSecurityManager. Within the blueprint I created an instance of DefaultWebSecurityManager and the id attribute holding the name I used to annotate. Within the init method I tried to inject the SecurityManagerContainer to get a reference to the configured SecurityManager.

    SecurityManagerContainer l_oContainer   = new SecurityManagerContainer();

    DefaultWebEnvironment    l_oEnvironment = new DefaultWebEnvironment();

    InjectorHolder.getInjector().inject(l_oContainer, SecurityManagerContainer.class);

    l_oEnvironment.setSecurityManager  (l_oContainer.getSecurityManager());

    getServletContext().setAttribute(EnvironmentLoader.ENVIRONMENT_ATTRIBUTE_KEY, l_oEnvironment);

This fails on the inject call with the following exception on startup:

java.lang.IllegalStateException: INJECTION_SOURCE_SCAN cannot be used with neither blueprint nor spring context

at org.ops4j.pax.wicket.internal.injection.BundleAnalysingComponentInstantiationListener.createProxyTargetLocator(BundleAnalysingComponentInstantiationListener.java:156)[3471:org.ops4j.pax.wicket.service:2.1.1]

at org.ops4j.pax.wicket.internal.injection.BundleAnalysingComponentInstantiationListener.createProxy(BundleAnalysingComponentInstantiationListener.java:122)[3471:org.ops4j.pax.wicket.service:2.1.1]

at org.ops4j.pax.wicket.internal.injection.BundleAnalysingComponentInstantiationListener.inject(BundleAnalysingComponentInstantiationListener.java:112)[3471:org.ops4j.pax.wicket.service:2.1.1]

at org.ops4j.pax.wicket.internal.injection.BundleDelegatingComponentInstanciationListener.inject(BundleDelegatingComponentInstanciationListener.java:91)[3471:org.ops4j.pax.wicket.service:2.1.1]

at org.ops4j.pax.wicket.internal.injection.DelegatingComponentInstanciationListener.inject(DelegatingComponentInstanciationListener.java:100)[3471:org.ops4j.pax.wicket.service:2.1.1]

Now I'm a little bit lost. Any comment is highly welcome.

Are there easier solutions using Wicket and Shiro in OSGi environments??

Thank you all,

harald

====== blueprint ======

<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
          xmlns:wicket="http://www.ops4j.org/schema/wicket">

 <bean id="shiroRealm" class="org.apache.shiro.realm.text.IniRealm">
   <argument value="config/shiro.ini"/>
 </bean>

 <bean id="shiroSecurityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
   <property name="realm" ref="shiroRealm"/>
 </bean>

 <wicket:application id="TestApplicationId"
                     class="de.test.app.webui.TestApplication"
                     applicationName="TestApplication"
                     mountPoint="webui">
   <wicket:context-param>
     <wicket:param-name>configuration</wicket:param-name>
     <wicket:param-value>deployment</wicket:param-value>
   </wicket:context-param>
 </wicket:application>

 <wicket:autoPageMounter id="autoPageMounter"
                         applicationName="TestApplication”/>

 <wicket:filter          id="shiroFilter"
                         filterClass="org.apache.shiro.web.servlet.ShiroFilter"
                         priority="2"
                         applicationName="TestApplication"/>

</blueprint>

======= SecurityManagerContainer =======

public class SecurityManagerContainer

{

  @PaxWicketBean(name = "shiroSecurityManager")

  private WebSecurityManager m_oSecurityManager = null;

  public WebSecurityManager getSecurityManager()

  {

    return m_oSecurityManager;

  }

  public void setSecurityManager

  (

    WebSecurityManager p_oSecurityManager

  )

  {

    m_oSecurityManager = p_oSecurityManager;

  }

}

[Achim Nierbeck]

Hi, 

regarding the listener, that's easy ;)

you just need to create a bean for it and register as a service. Pax Web will pick it up and will use it accordingly. 

I'm sure that everything that can be done with Pax Web can also be combined with wicket, so for the security part you'll also need to use a custom HttpContext. The only peace you'll need to find out is how to connect this httpContext to your wicket application. 

I couldn't find this while scanning the wicket project. 

regards, Achim 

--
--
------------------
OPS4J - http://www.ops4j.org - op...@googlegroups.com

---
You received this message because you are subscribed to the Google Groups "OPS4J" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ops4j+un...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Apache Member

Apache Karaf <http://karaf.apache.org/> Committer & PMC
OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/> Committer & Project Lead
blog <http://notizblog.nierbeck.de/>

Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS>

Software Architect / Project Manager / Scrum Master 

[Gareth Collins]

Hi Harald,

Are you really wed to using shiro.ini? You could just do it programmatically.

I configured shiro programmatically creating a special OSGi
declarative services component just for setting up the security
manager and the filter chain resolver and registering these as
services. Then in each servlet that needed Shiro, as well as
registering the Shiro filter, I added the following in the
ServletListener contextInitialized method:

public void contextInitialized(ServletContextEvent sce) {

final ServletContext context = sce.getServletContext();
.
.
context.setAttribute(EnvironmentLoader.ENVIRONMENT_ATTRIBUTE_KEY, new
WebEnvironment() {

@Override
public SecurityManager getSecurityManager() {
return webSecurityManager;
}


@Override
public FilterChainResolver getFilterChainResolver() {
return filterChainResolver;
}


@Override
public ServletContext getServletContext() {
return context;
}


@Override

public WebSecurityManager getWebSecurityManager() {
return webSecurityManager;
}
});
.
.
}

Hope this helps.

regards,
Gareth