[
https://issues.apache.org/jira/browse/CAMEL-26323?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-26323.
---------------------------------
Resolution: Fixed
Fixed by https://github.com/apache/camel/pull/28522
> camel-shiro: ShiroSecurityProcessor should authenticate against policy
> security manager
> ---------------------------------------------------------------------------------------
>
> Key: CAMEL-26323
> URL: https://issues.apache.org/jira/browse/CAMEL-26323
> Project: Camel
> Issue Type: Bug
> Components: camel-shiro
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> h3. Current behaviour
> In {{org.apache.camel.component.shiro.security.ShiroSecurityPolicy}}
> ({{camel-shiro}}), constructors loading configuration from INI register the
> resulting {{SecurityManager}} in global static state via
> {{SecurityUtils.setSecurityManager(securityManager)}}.
> In
> {{org.apache.camel.component.shiro.security.ShiroSecurityProcessor.process(...)}}:
> {code:java}
> Subject currentUser = SecurityUtils.getSubject();
> {code}
> The processor obtains the {{Subject}} from global thread-bound or static
> state rather than building a subject associated directly with
> {{policy.getSecurityManager()}}.
> When multiple {{ShiroSecurityPolicy}} instances are configured in the same
> application, each policy should authenticate and evaluate subjects against
> its own configured {{SecurityManager}} without depending on or modifying
> global static state.
> h3. Expected behaviour
> Each {{ShiroSecurityPolicy}} should manage its own {{SecurityManager}}
> instance independently. {{ShiroSecurityProcessor}} should construct and
> authenticate the {{Subject}} directly using the current route policy's
> {{SecurityManager}} (for example via {{new
> Subject.Builder(policy.getSecurityManager()).buildSubject()}}), and clear any
> thread associations cleanly when processing completes.
> h3. Change
> * In {{ShiroSecurityPolicy}}:
> - Avoid calling {{SecurityUtils.setSecurityManager(...)}} in policy
> constructors.
> * In {{ShiroSecurityProcessor}}:
> - Build the {{Subject}} explicitly using {{policy.getSecurityManager()}}.
> - Ensure authentication, authorization checks, and logout are scoped to
> that explicit manager.
> * Add unit tests in {{camel-shiro}} verifying multiple policies configured
> with distinct managers operate independently.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
