Using JDBCRealm to authenticate user with Shiro <p>I am trying to authenticate a servlet running within Tomcat 6 using Shiro.</p> <p>I have the following shiro.ini file:</p> <pre><code>[main] ps = org.apache.shiro.authc.credential.DefaultPasswordService pm = org.apache.shiro.authc.credential.PasswordMatcher pm.passwordService = $ps aa = org.apache.shiro.authc.credential.AllowAllCredentialsMatcher sm = org.apache.shiro.authc.credential.SimpleCredentialsMatcher jof = org.apache.shiro.jndi.JndiObjectFactory jof.resourceName = jdbc/UserDB jof.requiredType = javax.sql.DataSource jof.resourceRef = true realm = org.apache.shiro.realm.jdbc.JdbcRealm realm.permissionsLookupEnabled = true realm.credentialsMatcher = $pm ; Note factories are automatically invoked via getInstance(), ; see org.apache.shiro.authc.config.ReflectionBuilder::resolveReference realm.dataSource = $jof securityManager.realms = $realm [urls] /rest/** = authcBasic /prot/** = authcBasic </code></pre> <p>And the following in my database:</p> <pre><code>mysql&gt; select * from users; +----------+------------------+----------+----------------------------------------------+--------------------------+ | username | email | verified | password | password_salt | +----------+------------------+----------+----------------------------------------------+--------------------------+ | admin | a.muys@********* | 1 | ojSiTecNwRF0MunGRvz3DRSgP7sMF9EAR77Ol/2IAY8= | eHp9XedrIUa5sECfOb+KOA== | +----------+------------------+----------+----------------------------------------------+--------------------------+ 1 row in set (0.00 sec) </code></pre> <p>If I use the <code>SimpleCredentialsManager</code> it authenticates fine against a plaintext password in the users table. Trying to use the <code>PasswordMatcher</code> has been extremely frustrating.</p> <p>The password and password_salt were obtained via the shiro-tools <code>Hasher</code> utility.</p> <p>When I try to authenticate against a basic <code>HelloWorld</code> servlet I use for testing (path=rest/hello, context=/ws), I get the following in the logs:</p> <pre><code>15:35:38.667 [http-8080-2] TRACE org.apache.shiro.util.ClassUtils - Unable to load clazz named [ojSiTecNwRF0MunGRvz3DRSgP7sMF9EAR77Ol/2IAY8=] from class loader [WebappClassLoader context: /ws delegate: false repositories: /WEB-INF/classes/ ----------&gt; Parent Classloader: org.apache.catalina.loader.StandardClassLoader@79ddd026 ] </code></pre> <p>(Full log at <a href="https://gist.github.com/recurse/5915693">https://gist.github.com/recurse/5915693</a> )</p> <p>It appears to be trying to load my hashed password as a classname. Is this a bug, or a configuration error on my part? If it is a bug, how can I work around it? If it is a configuration error, what am I missing?</p>