grails-shiro support for grails 3.0.x

[beneo]

When will it be ready for support grails 3.0.x ??

thx in advance

[ghost]

Great minds think alike :-) I just reached out to Peter Ledbrook and Peter McNeil - looks like a tentative game plan is in the works sometime very soon. This is a blocker for me so I am interested in seeing this go through.

[pmcneil]

Yep it shouldn't take too much to get it going. Hey either of you like doing doco ;-)

[ghost]

Sure, whatever is needed, just let me know and I'll happily oblige.

[ghost]

Also @pmcneil is this the best forum for detailed discussion/planning? I'm happy to use it but not sure if its the best format; does GitHub have a chat-type feature? IRC? If you'd like me to work on documentation (Groovy Docs, README, Grails plugin docs, etc.) I have quite a number of suggestions/ideas to bounce off of you.

[pmcneil]

This is as good as any, you can always email me if you like.

[pmcneil]

Looking at Grails 3.0 features it might be time to revisit the plugins features, e.g. with regard to

• the scripts going from Gant to Gradle.
• the potential of adding security traits since groovy 2.4 is in there
• using interceptors in stead of filters?
• profiles?
  We should also update to Shiro 1.2.3 from 1.2.2
  We also need to look at how we handle backwards compatibility - probably just branch the current release and upgrade to Shiro 1.2.3 for now (but then we need to clearly document the release versions and how to upgrade your application.)

[pmcneil]

Hmm, looking at the upgrade procedure we might be better off creating a new repo instead of a branch. maybe?

[pmcneil]

Re: new repo project thoughts -
Pros:

• A new Repo might be cleaner since the update process involves creating a whole new grails project and copying across files to new locations and changing where configuration is done. This has the potential to be a bit of a mess, and it also provides the opportunity to clean out any cruft and re-organise tests etc.
• I want to be able to cleanly support the older version of the plugin with back ports and updates of Shiro itself. Branching means if you switch branches, with so many changes including grails version, gradle build etc., the IDE will have a small fit keeping up :-)

Of course you'd keep checked out branches in separate directories with associated IDE project files... but if you do switch branches it could get messy.

Cons:

• Making a new project Repo may mean a new plugin, since the source repo would be different.
• You lose the history.
• back porting is not a merge - mind you it would not be a simple merge anyway.

Current thinking:

• it's probably better to branch the 2.x code and try to do the upgrade in the current repo and capture the moving of files - which will be interesting, if not fun.

[ghost]

I agree with a branch over a new repo, although I see what you are talking about. Like you said, I think it might make sense to use semver and release this new grails-shiro as 2.0 and then make it patently obvious in the docs that if clients are running Grails 1.x or 2.x, that they need to use a 1.x version of grails-shiro.

[pledbrook]

You can push your own copy of the repo to a new GitHub account/repo while retaining history. In other words, "new repo" doesn't necessarily mean losing history.

I also don't think merging is the right way to do a back port. It's easy enough to create a patch from one repo that can be applied to the other, or at least no more difficult than a merge between branches 😄

[pmcneil]

In case you're wondering what's happening... been busy at work. Also been trying to get all the original tests working again before porting. (just dependency manager and webdriver issues)

[pmcneil]

@pledbrook by new repo I meant starting a new git project root, thus losing the history. Tracking the moves in the upgrade to 3.0, and perhaps switching branches may cause a bit/lot of confusion (and re-indexing in IDEs...) anyway I'll suck it and see :-)

[emacadie]

Has any progress been made on this?

[pmcneil]

A little, I have a grails three project, that builds. New tests are needed. I got a bit snowed under with work (and waiting for intellij 15 for grails 3 support ;-) )

[emacadie]

If I may make a suggestion: Why not commit it? Perhaps the rest of the world could take a crack at some of the tests.

[yellowsnow]

Hi Gentlemen,

Is there a way I can help test the ongoing work? Is the code available somewhere? I have an app eagerly waiting for the migration. Keep groovying!

Cheers

[yellowsnow]

Hi,
I have a work in progress that you can check out here

I'll be happy to here your feedback.

Cheers

[pmcneil]

G'day @yellowsnow, cool. I've pretty much had to drop the ball on this. I' got the project migrated, keeping the old plugin as a separate project... but that's as far as I got.

So I restructured the project into shiro2 and shiro3 directories with the two separate projects.

@emacadie OK I'll just commit what I have done so far, I hadn't done it because I was prepared to just throw it away.

[pmcneil]

OK pushed the restructure, I'm open to pull requests to get this thing going.

[yellowsnow]

Hi,

Just sent a PR for shiro3, this is still work in progress, for now only unit tests are working. I will happilly continue working on it this week untill i see more light.

I've kept both folders shiro2 and shiro3, will they coexist like this? or will there be a different branch for each?

Cheers

[emacadie]

I will try out what YellowSnow and PMcNeil have pushed in a few test projects.

[yellowsnow]

Hi,
I have started migrating shiro2 test projects, you can follow the work in progress here. For the moment, it's just partial migration, none of them even compiles.

I propose to hook the travis build on these projects.

If you're ok with that, i have a few questions before further diving into it :

• Should all these test projects be kept?
  • annotation-test
  • cli-tests
  • default
  • native-realm-only
  • native-session
  • spring-filter
  • wildcard-realm
• Is a grails test-app good enough for testing every test project ?

[pmcneil]

Good question. I planned on revisiting the test projects. All those need to be tested, I'd like to combine the integration the testing with documentation ideally so that we test the doco, and document the tests.

grails test-app should be fine, works for me.

I was planning on scripting the tests with gvm to create apps in different grails versions (or at least some different grails version, like 2.4.3 and 2.4.4 which changed a lot).

[pmcneil]

On a side issue, in shiro 3 can we perhaps use application.groovy, not application.yml? Personally don't see the attaction of YAML here.

[yellowsnow]

Yes, definitely, i'd go too for application.groovy.

On Thu, Jul 23, 2015 at 11:04 AM, Peter McNeil notifications@github.com
wrote:

On a side issue, in shiro 3 can we perhaps use application.groovy, not
application.yml? Personally don't see the attaction of YAML here.

—
Reply to this email directly or view it on GitHub
#44 (comment)
.

[yellowsnow]

Hi @mrtsilva,

The shiro3 folder contains in fact the plugin code and a test project for each feature, not all features work though. The test suite uses a Gradle multi build setting :
https://github.com/pledbrook/grails-shiro/blob/master/shiro3/settings.gradle

I hope this helps.

Cheers

[sdthomas69]

@yellowsnow— What do you think is required to release the plugin as a Grails 3 plugin? I know you did a lot of work getting it to where it is now and would be glad help where I can. I just tested Jay’s bintray version with Grails 3.2.3 and it worked as expected.

…

-Shawn

On Jan 27, 2017, at 3:21 AM, yellowsnow ***@***.***> wrote: Hi @mrtsilva <https://github.com/mrtsilva>, The shiro3 folder contains in fact the plugin code and a test project for each feature, not all features work though. The test suite uses a Gradle multi build setting : https://github.com/pledbrook/grails-shiro/blob/master/shiro3/settings.gradle <https://github.com/pledbrook/grails-shiro/blob/master/shiro3/settings.gradle> I hope this helps. Cheers — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#44 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ANZWgOAQa9BHd0ggB2arrQjqflxm1ndOks5rWdNKgaJpZM4EIonV>.

[yellowsnow]

Hi @sdthomas69

I am sure @pmcneil or @pledbrook could better answer this question, btw i thank them for their work and guidance.

My guess is that a code review is needed, and also that fixing the JSESSIONID issue could help a lot :
#44 (comment)

Cheers

[animator013]

Yes, I am using this sources on my bintray repo. I removed the filterClasses because they have been deprecated.

Recently i had problem also with grails 3.2.x with stackoverflow errors and

org.apache.shiro.UnavailableSecurityManagerException: No SecurityManager accessible to the calling code, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton. This is an invalid application configuration.

I had to add to dispatcher types also the FORWARD request:

dispatcherTypes = EnumSet.of(REQUEST, ERROR, FORWARD)

Don't know what's with the JSESSIONID. Is it related only with tests ? I use the plugin in production without any problems.

[apandichi]

@animator013 Could you please share your source code on Github? It would help build trust for those who want to use the shiro-grails versions from https://bintray.com/animator013/plugins/grails-shiro/
For example, I'd like to know what the differences are between your versions 2.0.3, 2.0.2, 2.0.1 and 2.0.0.
Thanks!

[juanmartinvidal]

Hello, I just read through the entire thread. Are there any news regarding Shiro and Grails 3.x. I am currently creating a new project in Grails 3.3.3 to migrate an old one in 2.5 and got stuck with this issue.

Thanks in advance!
Cheers

[pmcneil]

@juanmartinvidal no there hasn't been any advance yet. I keep getting pulled away by other things (work/family/health) - we need to get this done, help accepted.

[sdthomas69]

I’d be willing to help out.

…

-Shawn

On Mar 8, 2018, at 2:57 PM, Peter McNeil ***@***.***> wrote: @juanmartinvidal <https://github.com/juanmartinvidal> no there hasn't been any advance yet. I keep getting pulled away by other things (work/family/health) - we need to get this done, help accepted. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#44 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ANZWgGGIh2dAu1hFEvX4D6UAM6Vt5M40ks5tcbdDgaJpZM4EIonV>.

[rohithkd]

Is there any documentation available for setting up https://bintray.com/animator013/plugins/grails-shiro/. The default shiro-quick-start was not working for me in Grails 3.3.3 for Bintray Shiro 3.0,2.

[j4y]

I don't think there is any documentation for Grails 3.x because the project seems to be abandoned.

My suggestion is to look at the forks of the project that have commits and you should find some answers.

[swEngineer4ever]

@juanmartinvidal I'm in a similar problem now, did you manage to find a solution?
Thanks in advance

[swEngineer4ever]

Hi guys,

What is the recommended approach for grails-shiro replacement in grails3.3.8? I'm upgrading currently to Grails 3.3.8 and stuck on grails-shiro plugin problem... tried spring-security-shiro plugin but as I see it doesn't replace grails-shiro :/ How to still use shiroSecurityManager bean and grails-app/realms in grails 3?

Thanks in advance

[robokaso]

this fork should work with grails 3.3.x https://github.com/softwareschneiderei/grails-shiro (haven't tested it yet myself)

[pmcneil]

@robokaso @jkassem let me know how you go with that fork and I'll pull/test and try to get this done.

[jkaytser]

Has there been an update for this?

[animator013]

I've made a pull request #67. Travis is failing, that needs a further look but i don't have enough time now.

[espoir]

Hi everyone,

Just to let you know that I'm almost done upgrading an application from Grails2.5 to Grails3.3.8 and grails-shiro works fine (I upgraded it to Grails3.3.8).

Thanks to all who worked on its upgrade.

[pmcneil]

G'day all,
I'm going to split this repo into a separate grails 3 version to make it easier to manage and upgrade, and will do a similar thing for grails 4. It will probably move to my nerderg organisation.
I'll publish an updated 3.3.10 compatible plugin as soon as I can (hopefully this week) and let everyone know about it.

[pmcneil]

So...
I'm basically re-writing the grails-shiro plugin for grails 3.3.10 using Shiro 1.4.1 because some things now don't make sense and some need to be better written.

I've been looking at the 'basic' DBRealm which attempts to emulate the database based access control definitions by defining 'actions' within the permissions. This approach really doesn't make much sense WRT Shiro as the Shiro concept of permissions and the conventional approach to Shiro permissions effectively allows you to define the actions within the permission anyway e.g. 'book:edit' or 'book:list,create,update,delete,view'

So the question is if I remove the DBRealm and just leave the WildcardDBRealm in the Shiro plugin would anyone be really upset?

Note lots of things weren't really working there anyway, and keeping this simple and secure is the aim.

[sdthomas69]

I think it sounds like a good idea (and I mainly use the WildcardDBRealm anyway).

…

-Shawn

On Jul 3, 2019, at 6:52 PM, Peter McNeil ***@***.***> wrote: So... I'm basically re-writing the grails-shiro plugin for grails 3.3.10 using Shiro 1.4.1 because something now don't make sense and things need to be better written. I've been looking at the 'basic' DBRealm which attempts to emulate the database based access control definitions by defining 'actions' within the permissions. This approach really doesn't make much sense WRT Shiro as the Shiro concept of permissions and the conventional approach to Shiro permissions effectively allows you to define the actions within the permission anyway e.g. 'book:edit' or 'book:list,create,update,delete,view' So the question is if I remove the DBRealm and just leave the WildcardDBRealm in the Shiro plugin would anyone be really upset? Note lots of things weren't really working there anyway, and keeping this simple and secure is the aim. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#44?email_source=notifications&email_token=ADLFNAG7P4RNQ455ZUIE6VTP5VJXJA5CNFSM4BBCRHK2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZGC4KI#issuecomment-508309033>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADLFNAAT4RC5YCMZK5SMRTDP5VJXJANCNFSM4BBCRHKQ>.

[yellowsnow]

+1 for removing the DBRealm too!

[pmcneil]

Also removing accessControl static property from controllers as they weren't working anyway and Annotations and Interceptors do the same job, this is just complication.
(after re-writing it and testing :-) )

[pmcneil]

Almost there https://github.com/nerdErg/grails-shiro :-)

[pmcneil]

OK it's up and awaiting approval from the grails team to go on the plugin portal.
In the mean time it is available here https://bintray.com/beta/#/nerderg/plugins/grails-shiro?tab=overview
(of course you can build it yourself from github) and doco is hosted at http://nerderg.com/docs/grails-shiro/ as well as via the github page.

Please test and let me know what you think.

[pmcneil]

See new grails 3 released plugin http://plugins.grails.org/plugin/nerderg/grails-shiro