Grails error-messages if I run the web app with tomcat 9

susi 0
Viewed 28

I'm updating a fairly large web app from Grails 2 to Grails 5. We are using the Shiro plugin (and others) and Java 11.

If I run the packaged war file under a tomcat-9 installation (currently with FreeBSD as the host os) I get the following errors:

org.apache.shiro.UnavailableSecurityManagerException: No SecurityManager accessible to the calling code, either bound to the org.apache.shiro.util.ThreadContext or as a vm static
singleton.  This is an invalid application configuration.
        at org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:123)
        at org.apache.shiro.subject.Subject$Builder.<init>(Subject.java:626)
        at org.apache.shiro.SecurityUtils.getSubject(SecurityUtils.java:56)
        at org.apache.shiro.grails.AccessControl.accessControlMethod(AccessControl.groovy:35)
        at org.apache.shiro.grails.AccessControl.accessControlMethod(AccessControl.groovy)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:107)
        at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:323)
        at org.codehaus.groovy.runtime.callsite.StaticMetaMethodSite.invoke(StaticMetaMethodSite.java:44)
        at org.codehaus.groovy.runtime.callsite.StaticMetaMethodSite.call(StaticMetaMethodSite.java:89)
        at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:157)
        at shiro.ShiroGrailsPlugin$_doWithDynamicMethods_closure3.doCall(ShiroGrailsPlugin.groovy:253)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)

etc.

But the app seems to work fine, if I'm not logged in, I'm redirected to the login page and afterwards to the pages of the app. Haven't tested with different permissions, but at first sight, it looks ok.

If I run it with "java -jar myApp.war", I don't have these error-messages.

The java-version for tomcat and the standalone start is the same.

Should be something with dependencies I think...

shiro grails
1 Answers

I cannot speak for the Grails side of things, but from a Shiro perspective:

It looks like you have a request that is being processed outside the scope of Shiro (i.e. either a request that is NOT behind the ShiroFilter), or you have a background or initialization thread calling a protected method (the stacktrace looks trimmed so it's hard to say)

If it's the former, the fix is to make sure all your requests go through the ShiroFilter (or equivalent Grails config), this will make sure a SecurityManager is bound to the request thread.

If it's the latter, take a look at: https://shiro.apache.org/static/1.9.1/apidocs/org/apache/shiro/web/servlet/AbstractShiroFilter.html (this is often used for background threads running on behalf of a user)

Brian Demers0
Related