title: Not able to get proper results using Apache Shiro configuration
body: <p>I am trying to use apache shiro into my project as I have to create a role based mechanism into my project. I created a demo project with following configurations...</p>
  
  <p>I created following files into my project - </p>
  
  <p><strong>index.jsp</strong></p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
  pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"&gt;
  &lt;title&gt;Shiro Web Test&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;h1&gt;This is a test for Shiro Web Framework&lt;/h1&gt;
  
  &lt;a href = "success.jsp"&gt;Click Here!&lt;/a&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>login.jsp</strong></p>
  
  <pre><code>&lt;%@ page language="java" contentType="text/html; charset=ISO-8859-1"
  pageEncoding="ISO-8859-1"%&gt;
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"&gt;
  &lt;title&gt;Shiro Web Test : Login Page&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;%! String errorMessage = null; %&gt;
  &lt;% 
  errorMessage = (String) request.getAttribute("shiroLoginFailure");
  if (errorMessage != null) { %&gt;
  &lt;font color="red"&gt;Invalid Login: ${errorMessage}&lt;/font&gt;&lt;br/&gt;
  &lt;font color="black"&gt;&lt;h3&gt;Enter login information...&lt;/h3&gt;&lt;/font&gt;
  &lt;% } else { %&gt;
  &lt;font color="black"&gt;&lt;h3&gt;Enter login information...&lt;/h3&gt;&lt;/font&gt;
  &lt;% } %&gt;
  
  &lt;form action="loginTest.do" method="POST"&gt;
  &lt;table&gt;
  &lt;tr&gt;
  &lt;td&gt;Username:&lt;/td&gt;
  &lt;td&gt;&lt;input type="text" name="username" placeholder="username" /&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
  &lt;td&gt;Password:&lt;/td&gt;
  &lt;td&gt;&lt;input type="password" name="password" placeholder="password" /&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;/table&gt;
  &lt;input type="checkbox" value="true" name="rememberMe" /&gt;Remember Me?&lt;br /&gt;
  &lt;input type="submit" value="Sign In" /&gt;
  &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>success.jsp</strong><br/>
  <strong>denied.jsp</strong><br/>
  <strong>logout.jsp</strong><br/>
  <strong>showUser.jsp</strong></p>
  
  <p>My <strong>shiro.ini</strong> configuration is as follows - </p>
  
  <pre><code># =======================
  # Shiro INI configuration
  # =======================
  
  [main]
  authc = org.apache.shiro.web.filter.authc.FormAuthenticationFilter
  roles = org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
  authc.loginUrl = /login.jsp
  authc.failureKeyAttribute = shiroLoginFailure
  roles.unauthorizedUrl = /denied.jsp
  
  [users]
  admin = password, ROLE_ADMIN
  member = password, ROLE_MEMBER
  
  [roles]
  ROLE_ADMIN = *
  
  [urls]
  /success.jsp = authc, roles[ROLE_MEMBER]
  /secret.jsp = roles[ROLE_ADMIN]
  </code></pre>
  
  <p>I am using a servlet <strong>LoginTestServlet.java</strong> to dispatch to <strong>login.jsp</strong> page or <strong>success.jsp</strong> after authentication is successful/unsuccessful - </p>
  
  <pre><code>public class LoginTestServlet extends HttpServlet {
      protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          generateResponse(request, response);
      }
  
      protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
          generateResponse(request, response);
      }
  
      protected void generateResponse(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
          UserCredentials user = new UserCredentials();
          user.setUserName(request.getParameter("username"));
          user.setPassword(request.getParameter("password"));
  
          if (user.getUserName() != null &amp;&amp; user.getPassword() != null) {
              Factory&lt;SecurityManager&gt; factory = new IniSecurityManagerFactory("classpath:shiro.ini");
              SecurityManager securityManager = factory.getInstance();
              SecurityUtils.setSecurityManager(securityManager);
              Subject currentUser = SecurityUtils.getSubject();
  
              UsernamePasswordToken token = new UsernamePasswordToken(user.getUserName(), user.getPassword());
  
              try {
                  currentUser.login(token);
                  Session session = currentUser.getSession();
                  session.setAttribute("user", user.getUserName());
              } catch (UnknownAccountException uae) {
                  request.setAttribute("shiroLoginFailure", uae.getMessage());
                  System.err.println("Exception type: " + uae.getClass().getName());
                  System.err.println("Error due to: " + uae.getMessage());
              } catch (IncorrectCredentialsException iae) {
                  request.setAttribute("shiroLoginFailure", iae.getMessage());
                  System.err.println("Exception type: " + iae.getClass().getName());
                  System.err.println("Error due to: " + iae.getMessage());
              } catch (LockedAccountException lae) {
                  request.setAttribute("shiroLoginFailure", lae.getMessage());
                  System.err.println("Exception type: " + lae.getClass().getName());
                  System.err.println("Error due to: " + lae.getMessage());
              } catch (AuthenticationException ae) {
                  request.setAttribute("shiroLoginFailure", ae.getMessage());
                  System.err.println("Exception type: " + ae.getClass().getName());
                  System.err.println("Error due to: " + ae.getMessage());
              } catch (Exception e) {
                  request.setAttribute("shiroLoginFailure", e.getMessage());
                  System.err.println("Exception type: " + e.getClass().getName());
                  System.err.println("Error due to: " + e.getMessage());
              }
  
              RequestDispatcher view = null;
  
              if (currentUser.isAuthenticated() &amp;&amp; currentUser.hasRole("ROLE_MEMBER")) {
                  view = request.getRequestDispatcher("success.jsp");
                  view.forward(request, response);
              } else if (currentUser.isAuthenticated() &amp;&amp; currentUser.hasRole("ROLE_ADMIN")) {
                  view = request.getRequestDispatcher("secret.jsp");
                  view.forward(request, response);
              } else {
                  view = request.getRequestDispatcher("login.jsp");
                  view.forward(request, response);
              }
          }
      }//end of generateResponse()
  
  }//end of class
  </code></pre>
  
  <p>I am using TOMCAT 6.0.</p>
  
  <p>My problem is - </p>
  
  <ol>
  <li>Whenever I am trying to enter credentials at <strong>login.jsp</strong> page, its automatically taking me to the respective page for the credentials I enter. Ex., if I try to enter ROLE_MEMBER credentials after clicking for <strong>success.jsp</strong>, its taking me to <strong>success.jsp</strong> page. But if I try to enter ROLE_ADMIN after clicking for same <strong>success.jsp</strong>, its automatically taking me to <strong>secret.jsp</strong> as per the servlet code written instead of going to <strong>denied.jsp</strong>.</li>
  <li>How to make a generic code without writing a separate servlet for each resource to show login success or denied page?</li>
  </ol>
  
  <p>Also, is there any way to create custom permissions in shiro for every resource? If yes, then how. If there is any link to this, I would be grateful to you.</p>
  
  <p>Thanks all.</p>