[SHIRO-879] spring boot errorPageFilter is not eligible for getting processed by all BeanPostProcessors

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.9.0
• Component/s: Configuration
• Environment: spring boot 2.6.6 ; standalone apache-tomcat-9.0.62

Language

Java

• Assignee: Unassigned
• Reporter: kretz kuang
• Created: 11/Apr/22 12:16
• Updated: 04/Aug/23 19:21

Description

Integration with spring boot 2.6.6， Deployed in standalone Tomcat.

Inject Bean Map<String, Filter> filterMap, initialize errorPageFilter is too early, when build Bean ShiroFilterFactoryBean. Cause BasicErrorController injection failure,  unable to add default error handling path /error. 

The reason is that ErrorPageFilter is not processed by ErrorPageRegistrarBeanPostProcessor.

Fix it like this:

change class AbstractShiroWebFilterConfiguration

@Autowired(required = false)
protected Map<String, Filter> filterMap;

to 

@Autowired(required = false)
@Qualifier("shiroFilters")
protected Map<String, Filter> filterMap;

 It's just that we need to qualify name as shiroFilters  in custom filters.

@Bean
public Map<String, Filter> shiroFilters(AuthorizationManager authorizationProvider) {
   Map<String, Filter> filters = new HashMap<>();
   filters.put("authc", new CaptchaFormAuthenticationFilter());
   filters.put("perms", new UrlAuthorizationFilter(authorizationProvider));
    return filters;
}

 At present, I give up using ShiroWebFilterConfiguration and configure ShiroFilterFactoryBean separately.

 The complete configuration is as follows :

@Configuration
@ConditionalOnProperty(name = "shiro.web.enabled", matchIfMissing = true)
public class ShiroWebFilterConfiguration {
    
    @Autowired
    protected SecurityManager securityManager;
    @Autowired
    protected ShiroFilterChainDefinition shiroFilterChainDefinition;
    @Autowired(required = false)
    @Qualifier("shiroFilters")
    protected Map<String, Filter> filterMap;
    @Value("#{ @environment['shiro.loginUrl'] ?: '/login.jsp' }")
    protected String loginUrl;
    @Value("#{ @environment['shiro.successUrl'] ?: '/' }")
    protected String successUrl;
    @Value("#{ @environment['shiro.unauthorizedUrl'] ?: null }")
    protected String unauthorizedUrl;
    protected List<String> globalFilters() {
        return Collections.singletonList(DefaultFilter.invalidRequest.name());
    }

    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean filterFactoryBean = new ShiroFilterFactoryBean();
        filterFactoryBean.setLoginUrl(loginUrl);
        filterFactoryBean.setSuccessUrl(successUrl);
        filterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
        filterFactoryBean.setSecurityManager(securityManager);
        filterFactoryBean.setGlobalFilters(globalFilters());
        filterFactoryBean.setFilterChainDefinitionMap(shiroFilterChainDefinition.getFilterChainMap());
        filterFactoryBean.setFilters(filterMap);
        return filterFactoryBean;
    }

 

However, using embedded Tomcat will not cause this problem