oscerd opened a new pull request, #28522: URL: https://github.com/apache/camel/pull/28522
Jira: https://issues.apache.org/jira/browse/CAMEL-26323 ### Problem In `ShiroSecurityPolicy` (camel-shiro), constructors that load configuration from an INI file or object register the resulting `SecurityManager` globally via `SecurityUtils.setSecurityManager(securityManager)`. In `ShiroSecurityProcessor.process(...)`: ```java Subject currentUser = SecurityUtils.getSubject(); ``` The processor obtains the `Subject` from global static or thread-bound state rather than associating it directly with `policy.getSecurityManager()`. When multiple `ShiroSecurityPolicy` instances are configured in the same application, each policy should authenticate and evaluate subjects against its own configured `SecurityManager` without modifying or relying on global static state. ### Change - `ShiroSecurityPolicy`: - Removed calls to `SecurityUtils.setSecurityManager(...)` from constructors. - `ShiroSecurityProcessor`: - Added `resolveSubject()` to construct and resolve the `Subject` directly against the policy's `SecurityManager` using `new Subject.Builder(policy.getSecurityManager()).buildSubject()`. - Bind the resulting subject and security manager to `ThreadContext` and unbind cleanly in `finally` when `alwaysReauthenticate=true`. - Upgrade guide 4.24: Added a note documenting that `ShiroSecurityPolicy` scopes the `SecurityManager` to the policy instance and `ShiroSecurityProcessor` resolves subjects against the policy manager. ### Tests - Added `ShiroMultiplePolicyIsolationTest` in `camel-shiro` verifying that: - Multiple `ShiroSecurityPolicy` instances with distinct configurations and user realms authenticate and authorize independently without crosstalk across routes (`alwaysReauthenticate=true`). - Route policies isolate subject authentication independently when `alwaysReauthenticate=false`. - All 24 tests in `camel-shiro` pass. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
