Springboot Apache Shiro Login page redirected you too many times

40 Views Asked by At

I'm having some troubles in my Springboot app using Apache Shiro as a Security Framework, when i called the login page, it's always give me "redirected you too many times." error.

I'm using this XML based shiro setting :

<bean id="cacheManagerShiro" class="org.apache.shiro.cache.ehcache.EhCacheManager">
    <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml" />
</bean>
<bean id="credentialsMatcher" class="com.newtouch.lion.web.shiro.credentials.RetryLimitHashedCredentialsMatcher">
    <constructor-arg ref="cacheManagerShiro" />
    <property name="hashAlgorithmName" value="sha1" />
    <property name="hashIterations" value="2" />
    <property name="storedCredentialsHexEncoded" value="true" />
    <property name="retryMaxCount"  value="5"/>
</bean>
<bean id="userRealm" class="com.newtouch.starter.core.web.shiro.realm.CustomUserRealm">
    <property name="credentialsMatcher" ref="credentialsMatcher" />
    <property name="cachingEnabled" value="true" />
    <property name="authenticationCachingEnabled" value="true" />
    <property name="authenticationCacheName" value="authenticationCache" />
    <property name="authorizationCachingEnabled" value="true" />
    <property name="authorizationCacheName" value="authorizationCache" />
</bean>
<bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator" />
<bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
    <constructor-arg value="sid" />
    <property name="httpOnly" value="true" />
    <property name="maxAge" value="-1" />
</bean>
<bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
    <constructor-arg value="rememberMe"/>
    <property name="httpOnly" value="true"/>
    <property name="path" value="/admin"/>        
</bean>
<bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
    <property name="cipherKey"  value="#{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}"/>
    <property name="cookie" ref="rememberMeCookie"/>
</bean>
<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
    <property name="activeSessionsCacheName" value="shiro-activeSessionCache" />
    <property name="sessionIdGenerator" ref="sessionIdGenerator" />
</bean>
<bean id="sessionValidationScheduler" class="com.newtouch.starter.core.web.shiro.session.QuartzSessionValidationScheduler">
    <property name="sessionValidationInterval" value="1800000" />
    <property name="sessionManager" ref="sessionManager" />
</bean>
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
    <property name="globalSessionTimeout" value="36000000" />
    <property name="deleteInvalidSessions" value="true" />
    <property name="sessionValidationSchedulerEnabled" value="true" />
    <property name="sessionValidationScheduler" ref="sessionValidationScheduler" />
    <property name="sessionDAO" ref="sessionDAO" />
    <property name="sessionIdCookieEnabled" value="true" />
    <property name="sessionIdCookie" ref="sessionIdCookie" />
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="userRealm" />
    <property name="sessionManager" ref="sessionManager" />
    <property name="cacheManager" ref="cacheManagerShiro" />
    <property name="rememberMeManager" ref="rememberMeManager"/>
</bean>
<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager" />
    <property name="arguments" ref="securityManager" />
</bean>
<bean id="formAuthenticationFilter" class="com.newtouch.lion.web.shiro.filter.AjaxFormAuthenticationFilter">
    <property name="rememberMeParam" value="rememberMe"/>
    <property name="usernameParam" value="username" />
    <property name="passwordParam" value="password" />
    <property name="loginUrl"     value="/login.htm" />
    <property name="successUrl" value="/index.htm" />
</bean>
<bean id="forceLogoutFilter" class="com.newtouch.lion.web.shiro.filter.ForceLogoutFilter">
    <property name="forceLogoutUrl" value="/loginerror.htm"/>
    <property name="sessionCacheManager" ref="sessionCacheManager"/>
</bean>
<bean id="sessionControlFilter" class="com.newtouch.lion.web.shiro.filter.SessionControllerFilter">
    <constructor-arg index="0" ref="cacheManagerShiro" />
    <property name="sessionManager" ref="sessionManager"/>
    <property name="maxSession" value="1"/>
    <property name="forceLogoutUrl" value="/loginerror.htm"/>
    <property name="forceLogoutAfter" value="true"/>
</bean>
<bean id="sessionCacheManager" class="com.newtouch.lion.web.shiro.cache.SessionCacheManager">
    <property name="cacheManager" ref="cacheManagerShiro"/>
</bean>
<bean id="logoutFilter" class="com.newtouch.lion.web.shiro.filter.LogoutSessionFilter">
    <property name="redirectUrl"  value="/login.htm"/>
    <property name="sessionCacheManager" ref="sessionCacheManager"/>
</bean>
<bean id="ajaxPermissions" class="com.newtouch.lion.web.shiro.filter.AjaxPermissionshorizationFilter"/>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager" />
    <property name="loginUrl" value="/login.htm" />
    <property name="unauthorizedUrl" value="/unauthorized.htm" />
    <property name="successUrl" value="/index.htm"/>
    <property name="filters">
        <util:map>
            <entry key="authc" value-ref="formAuthenticationFilter" />
            <entry key="forceLogoutFilter" value-ref="forceLogoutFilter"/>
            <entry key="logoutFilter" value-ref="logoutFilter"/>
            <entry key="perms" value-ref="ajaxPermissions"/>
        </util:map>
    </property>
    <property name="filterChainDefinitionMap" ref="filterChainDefinitionManager"/>
</bean>
<bean  id="filterChainDefinitionManager" class="com.newtouch.starter.core.web.shiro.chain.ShiroFilterChainDefinitionManager">
    <property name="filterChainDefinitions">
        <value>
            /rest/** = anon
            /ws/** = anon
            /resources/** = anon
            /unauthorized.htm =anon
            /loginerror.htm=anon
            /i18n/language.htm = anon
            /login.htm = authc
            /unauthorized.htm = authc
            /logout.htm=logoutFilter
            /** = authc
        </value>
    </property>
</bean>
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

The code for login page using "username" & "password" is already added too in the project.

For those who understand how shiro work & noticed if other config file is needed, i will provide the other config file if necessary.

Any help would be very appreciated. Thank you.

0

There are 0 best solutions below