title: Web-Application Security with Apache Shiro Configuration Problems
body: <p>I decided to use Shiro to secure my webapplication. I use a tomcat app server, maven, hibernate and jsf. Now I tried to configure Shiro but got some problems.</p>
  
  <p>Here are my files:</p>
  
  <p>---POM.xml---</p>
  
  <pre><code>            &lt;dependency&gt;
                      &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
                      &lt;artifactId&gt;shiro-core&lt;/artifactId&gt;
                      &lt;version&gt;1.0.0-incubating&lt;/version&gt;
              &lt;/dependency&gt;
              &lt;dependency&gt;
                      &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
                      &lt;artifactId&gt;shiro-web&lt;/artifactId&gt;
                      &lt;version&gt;1.0.0-incubating&lt;/version&gt;
              &lt;/dependency&gt;
              &lt;dependency&gt;
                      &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;
                      &lt;artifactId&gt;shiro-aspectj&lt;/artifactId&gt;
                      &lt;version&gt;1.0.0-incubating&lt;/version&gt;
              &lt;/dependency&gt;
  </code></pre>
  
  <p>---web.xml---</p>
  
  <pre><code> &lt;servlet&gt;
      &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;
        javax.faces.webapp.FacesServlet
      &lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
  
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.xhtml&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
  
    &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;welcome.xhtml&lt;/welcome-file&gt;
    &lt;/welcome-file-list&gt;
  
    &lt;filter&gt;
      &lt;filter-name&gt;SecurityFilter&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.shiro.web.servlet.IniShiroFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
      &lt;param-name&gt;config&lt;/param-name&gt;
              &lt;param-value&gt;
  
                    [main]
  
                    myrealm = com.misPartidos.web.MyRealm
  
           &lt;/param-value&gt;
  
      &lt;/init-param&gt;
          &lt;/filter&gt;
  
          &lt;filter-mapping&gt;
              &lt;filter-name&gt;SecurityFilter&lt;/filter-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>If I deploy to the server I get this error message:</p>
  
  <pre><code>ERROR: Exception starting filter ShiroFilter
  java.lang.ClassNotFoundException: org.apache.shiro.web.servlet.IniShiroFilter
          at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1645)
          at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1491)
          at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:269)
          at org.apache.catalina.core.ApplicationFilterConfig.setFilterDef(ApplicationFilterConfig.java:422)
          at org.apache.catalina.core.ApplicationFilterConfig.&lt;init&gt;(ApplicationFilterConfig.java:115)
          at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4001)
          at org.apache.catalina.core.StandardContext.start(StandardContext.java:4651)
          at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
          at org.apache.catalina.core.StandardHost.start(StandardHost.java:785)
          at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
          at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:445)
          at org.apache.catalina.core.StandardService.start(StandardService.java:519)
          at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
          at org.apache.catalina.startup.Catalina.start(Catalina.java:581)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
          at java.lang.reflect.Method.invoke(Method.java:597)
          at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
          at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)
  30.07.2010 10:14:34 org.apache.catalina.core.StandardContext start
  ERROR: Error filterStart
  </code></pre>
  
  <p>Where is my mistake? Do I need to implemnt something else as well?
  Thank you for help
  Sven</p>
  
  <hr>
  
  <h2>Additional</h2>
  
  <p>I thought a bit about the problem. I think the key is to set the realm. But to test this framework I don't want to add a database or ldap. I need an easy solution...</p>
  
  <hr>
  
  <h2>Update</h2>
  
  <p>I changed the web.xml as follows:</p>
  
  <pre><code>&lt;init-param&gt;
      &lt;param-name&gt;config&lt;/param-name&gt;
          &lt;param-value&gt;
  
          [main]
  
          [users]
  
          tom = secret, admin
          paul = secret, user
  
          [roles]
  
          admin = *
          user = *
  
           &lt;/param-value&gt;
  
      &lt;/init-param&gt;
  </code></pre>
  
  <p>But the error remains the same :-/</p>