Delayed Session Processing

Question

My standalone security management application uses Shiro . I ran into a problem with expired sessions. If the user session has expired, and when I try to register the user, I get the following exception. Can anyone help?

 org.apache.shiro.session.UnknownSessionException: There is no session with id [d32af383-5f26-463f-a2f0-58a0e82c7890]
  at org.apache.shiro.session.mgt.eis.AbstractSessionDAO.readSession (AbstractSessionDAO.java:170)
  at org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSessionFromDataSource (DefaultSessionManager.java:236)
  at org.apache.shiro.session.mgt.DefaultSessionManager.retrieveSession (DefaultSessionManager.java:222)
  at org.apache.shiro.session.mgt.AbstractValidatingSessionManager.doGetSession (AbstractValidatingSessionManager.java:118)
  at org.apache.shiro.session.mgt.AbstractNativeSessionManager.lookupSession (AbstractNativeSessionManager.java:105)
  at org.apache.shiro.session.mgt.AbstractNativeSessionManager.lookupRequiredSession (AbstractNativeSessionManager.java:109)
  at org.apache.shiro.session.mgt.AbstractNativeSessionManager.stop (AbstractNativeSessionManager.java:238)
  at org.apache.shiro.session.mgt.DelegatingSession.stop (DelegatingSession.java:127)
  at org.apache.shiro.session.ProxiedSession.stop (ProxiedSession.java:107)
  at org.apache.shiro.subject.support.DelegatingSubject $ StoppingAwareProxiedSession.stop (DelegatingSubject.java:419)
  at org.apache.shiro.session.ProxiedSession.stop (ProxiedSession.java:107)
  at org.apache.shiro.subject.support.DelegatingSubject $ StoppingAwareProxiedSession.stop (DelegatingSubject.java:419)

I use spring to configure shiro

<bean id="securityManager" class="org.apache.shiro.mgt.DefaultSecurityManager"> <property name="realm" ref="myRealm"/> <property name="sessionManager.globalSessionTimeout" value="3600000" /> </bean> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean"> <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/> <property name="arguments" ref="securityManager"/> </bean> 

Answer 1

I am facing the same issue when using remote ejb for authentication.

As a workaround, the first login attempt is in the try / catch block, catching an UnknownSessionException . A Subject then created from scratch to re-enter the user's system.

 UsernamePasswordToken token = new UsernamePasswordToken(username, password); try { subject.login(token); } catch (UnknownSessionException use) { subject = new Subject.Builder().buildSubject(); subject.login(token); session = subject.getSession(true); }