deluan / shiro-faces

JSF 2 TagLib for Apache Shiro. This taglib reimplements all original JSP tags as their Facelets equivalent, so they can be used in JSF projects.

To use it in your maven project, add the following repository to your pom.xml:

    <repositories>
            <repository>
                <snapshots>
                    <enabled>false</enabled>
                </snapshots>
                <id>bintray-deluan-maven</id>
                <name>bintray</name>
                <url>http://dl.bintray.com/deluan/maven</url>
            </repository>
    </repositories>

And add the jar dependency:

    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-faces</artifactId>
        <version>2.0</version>
    </dependency>

shiro-faces's Issues

Bintray Forbidden response

When compile application using shiro-faces console shows following

...
...
Downloading from bintray-deluan-maven: http://dl.bintray.com/deluan/maven/com/sun/mail/jakarta.mail/maven-metadata.xml
...
...
Could not transfer metadata com.sun.mail:jakarta.mail/maven-metadata.xml from/to bintray-deluan-maven (http://dl.bintray.com/deluan/maven): Authorization failed for http://dl.bintray.com/deluan/maven/com/sun/mail/jakarta.mail/maven-metadata.xml 403 Forbidden

GoogleCode was shut down, shiro-faces maven repository is not available anymore

Hi there,
I think the title of this issue tells everything. Currently there is no maven repo for shiro faces...

shiro-faces do not support myfaces?

Shiro-faces do not support myfaces?

Official support?

Hi there,

have you tried contacting the committers of Apache Shiro? It would be a nice add to the official repo.

I am also using JavaServer Faces and Shiro and played around with implementing some custom components. Glad you already did the work. Just found you on accident.

JSP are deprecated, this is the way to go.

XSS vulnerable

<shiro:principal property="name"/> suffers from XSS. Is it possible to enable some sort of "escape='true'" like in JSF?

Composite component woes

This looked like a reasonable way to implement a login/logout link:

  <shiro:guest>
    Welcome, guest! <h:link outcome="pretty:login" value="Login"/>
  </shiro:guest>
  <shiro:authenticated>
    Welcome back, <shiro:principal/>! 
    <h:commandLink value="Logout" action="#{authenticationUI.logout}"/>
  </shiro:authenticated>

This works perfectly in an ordinary Facelets page. But if I move it into a composite component, it works fine except the <shiro:principal/> tag displays the empty string.

Thanks!

<shiro:hasPermission> breaks action attribute of nested component

I have this code in the UI:

<shiro:hasPermission name="course:delete:#{courseUI.course.id}">
  <h:form>
    <h:commandButton 
      value="Delete #{courseUI.shortCode}" 
      action="#{courseUI.delete}"/>
  </h:form>
</shiro:hasPermission>

When the button is rendered, clicking it causes a page reload, but nothing happens in the backend--my delete method is never invoked. Swapping the order of <h:form> and <shiro:hasPermission> has no effect on the problem.

Switching to this implementation does work, however:

<h:form>
  <h:commandButton 
    value="Delete #{courseUI.shortCode}" 
    action="#{courseUI.delete}"
    rendered="#{courseUI.canDelete}"/>
</h:form>

Going against this backend:

public String delete() {
  SecurityUtils.getSubject().checkPermission("course:delete:" + course.getId());
  user.removeCourse(course);
  return "pretty:home";
}

public boolean getCanDelete() {
  return SecurityUtils.getSubject().isPermitted("course:delete:" + course.getId());
}

So it suggests that the <shiro:hasPermission> tag is somehow interfering with the action method of the nested <h:commandButton>.

Allow attributes to be JSF EL expressions

The tags should allow attributes to be JSF EL expressions so the list of permission strings can be dynamically generated using a backing bean.