[SHIRO-841] NullPointerException from SessionsSecurityManager.start()

• Type: Task
• Status: Resolved
• Priority: Minor
• Resolution: Resolved
• Fix Version/s: 2.0.0-alpha, 1.9.0
• Assignee: Francois Papon
• Reporter: Attila Magyar
• Created: 04/Nov/21 11:11
• Updated: 15/Jan/22 21:16
• Resolved: 15/Jan/22 20:56

Description

We see this NPE intermittently from KNOX when a topology is being redeployed and a request is still being processed in Shiro's AuthenticatingFilter.

In DelegatingSubject.java:

log.trace("Starting session for host {}", getHost());
SessionContext sessionContext = createSessionContext();
// At this point the topology deploy already triggered a securityManager.destroy() so sessionManager is null
Session session = this.securityManager.start(sessionContext); 
this.session = decorate(session); 

This is not a critical problem since the request will fail no matter what, but NPE suggests a programming error instead of a normal operation.

I suggest putting a null check in securityManager.start() and throw an IllegalStateException("Session already destroyed") or something similar.

 

See https://issues.apache.org/jira/browse/KNOX-2297 for more context.

Issue Links

• causes: KNOX-2297 NPE during Shiro cleanup?
• links to: GitHub Pull Request #329