[SHIRO-411] Authentication not required for welcome-files in web.xml

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 1.2.1
• Component/s: Authorization (access control) , Realms , Web
• Labels: cas
• Environment: Win 7, Glassfish 3.1.2.2 or Tomcat 7
• Assignee: Unassigned
• Reporter: Peter Bočák
• Created: 15/Jan/13 13:52
• Updated: 08/May/13 20:59
• Resolved: 05/May/13 00:23

Description

Sample CAS server configuration as it was described in http://shiro.apache.org/cas.html (Complete configuration sample) doesn't require authentication for welcome files defined in web.xml.

INI configuration [urls]:
/shiro-cas = casFilter
/protected/** = roles[ROLE_USER]
/** = anon

web.xml:
<welcome-file-list>
<welcome-file>protected/index.xhtml</welcome-file>
</welcome-file-list>

When I access URL localhost:8080/shiro-cas/protected/index.xhtml shiro correctly redirects me to CAS server for authentication.
But if I access localhost:8080/shiro-cas/, application redirects me to specified welcome file /protected/index.xhtml without authentication.