CODEWITHSUNDEEP
grailsshiro
John Moore
John Moore

Reputation: 7129

Shiro - "No SecurityManager accessible to the calling code..." exception in Grails app

I'm in the process of converting a rather large Grails 2 application to Grails 4. It uses the Shiro plugin, which I have upgraded to version 4.3 (compile "org.grails.plugins:grails-shiro:4.3"). In one large GSP (which has always worked OK), the Shiro taglib is now causing the following error:

Error executing tag <shiro:isLoggedIn>: No SecurityManager accessible to the calling code, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton. This is an invalid application configuration.

The SecurityManager is initialized OK in Bootstrap.groovy, and in another simple test page, shiro:isLoggedIn works fine. So my question is why might the SecurityManager not be available in this use of the taglib? What should I be looking out for?

Upvotes: 1

Views: 1112

Answers (2)

pmc
pmc

Reputation: 1005

G'day John, I look after the grails shiro plugin. That error occurs in the taglib because for some reason I'm trying to track down, the ThreadContext doesn't appear to be available. That means the SecurityUtils goes looking for a static security Manager which isn't normally set in web applications.

So basically it's a bug, and hopefully I'll fix it shortly (help welcome).

Upvotes: 1

Brian Demers
Brian Demers

Reputation: 2080

I'm not a Grails person, but one common reason folks see this problem is that the ShiroFilter did not process the request (or the filter is not configured early enough in the chain).

What happens is the ShiroFilter creates a Subject (the user) and associates it and the SecurityManager with the request thread. Other API (like the tag lib) would use that Subject and/or SecurityManager.

Check your servlet filters, maybe compare them with the old version with the new version and see what has changed.

Upvotes: 1

Related Questions