shiro | integrating Shiro into SSM to control the authority | Security Framework library

Sounds like your problem is related to Guice 4, and less about Shiro. Instead of re-using the same binding key, define a new one, something like:

LDAP: error code 49 - INVALID_CREDENTIALS Means, three things, Username/password is incorrect or the account is locked. You are having this error for Bind user.

You need to verify you systemUsername and systemPassword in configured topology.

A tool ldapsearch can be useful to verify credentials for Bind user.

main.ldapRealm.userDnTemplate should be like following

You may want to consider user behavior here. If your webapp makes it look like a user was unable to logout, (IMHO) the first thing the user will do is try again, the second thing is they will call the help desk and try to reset their password.

This depends on your actual application, (so take this with a grain of salt). I'd suggest letting the user login and then blocking access e.g. show a 403 page with a ("You shall not pass" warning), or show a 404 (this is what GitHub does as it does NOT leak information that a valid page exists).

This also simplifies the Shiro implementation, just require a role/permission for your routes.

As per ZEPPELIN-5184 and PR-4008, In 0.9.0, we need to define just the interpreter name in credentials.

Check ZEPPELIN-5189 for more details.

Optional dependencies are just that: Optional.

Using Shiro in your case as reference.

Optional Dependencies: Typically an optional dependency is not required for the core functionality of the library you are referencing. In this case, Shiro is only required if you intend to make use of Apache Shiro features or functionality. Shiro is used for security and therefore makes sense that it will not be used by everyone making use of ActiveMQ.

Versions: Many times (not always) optional dependency versions are not set in stone and it may be possible to use newer versions without breaking the functionality. This is not always the case, so if you aim to do this, start with the preferred version and only upgrade after the functionality is working to test.

Vulnerabilities: Simply because a vulnerability exists, does not make it applicable to your use case. Just because there is a known vulnerability in a dependency that can do XYZ, it will likely not affect you if your use case does not make use of XYZ. A security report such as the Apache Shiro one could help in understanding this.

Additionally: I would suggest that you look into Maven or Gradle for your Java projects. This will take away some of the need to worry about these types of dependency management issues as optional dependecies are not included in the dependecy hierarchy by default.

I add ds.validationQuery = select 1 from dual part to shiro.ini file so bug was fixed

If you are using JSPs you could use the Shiro Tag lib

OR

Calling request.getUserPrincipal().getName() should return the Subject's username.

OR

You can likely get the info you need from calling Subject.getPrincpal() too, though this depends on the implementation of your realms.

The ServletContainerSessionManager is just a wrapper around the session management your Servlet container provides. If you want to use Shiro's SessionListner you would need to use a different SessionManager implementation, such as DefaultWebSessionManager

Spring's complaint is that you haven't defined a Bean of type ProjectMapper, which it is saying that it needs to satisfy an Autowire request. Looking at your code, I don't see a definition for such a Bean in what you've shown us here.

The exact point of the problem is hidden, I'm guessing, because you aren't showing us the definition of the ServiceImpl class. My guess is that that's where the actual reference is that Spring is trying to wire up. Apparently, the field name is baseMapper.