title: Shiro URL filter not working
body: <p>I have created a simple JSF login page and am using Apache Shiro to provide the authentication and authorisation mechanism, however the URL filters specified in the shiro.ini do not appear to be working.</p>
  
  <p>In the root WebContent directory I have two files named "test.xhtml" and "login.xhtml" which would be accessible by anyone without the need to login. I also have a subdirectory called "protected" containing a file called "success.xhtml" which should only be accessible after the user has logged in.</p>
  
  <p>When the [urls] section of the shiro.ini file contains <code>/protected/** = myFilter</code> the user is able to access the protected/success.xhtml page without logging in. When the [urls] section of the shiro.ini file contains <code>/** = myFilter</code> the xhtml page is not rendered by JSF and instead the user is prompted to download the xhtml file.</p>
  
  <p>Is anyone able to suggest how I can configure Shiro to allow anyone access to the pages in the WebContent root directory but only allow users who have logged in access to pages in the protected subdirectory?</p>
  
  <p>I am using Apache MyFaces 2.1.5 and Shiro 1.2.1.</p>
  
  <p>The full contents of the shiro.ini file is as follows:</p>
  
  <pre><code>[main]
  myFilter = org.apache.shiro.web.filter.authc.PassThruAuthenticationFilter
  myFilter.loginUrl = /login.xhtml
  myFilter.successUrl = /protected/success.xhtml
  
  [users]
  user01 = user01, Users
  user02 = user02, Users
  
  [roles]
  Users = *
  
  [urls]
  /protected/** = myFilter
  </code></pre>
  
  <p>The contents of the web.xml file is as follows:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app id="WebApp_ID" version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;display-name&gt;FooBarWeb&lt;/display-name&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;javax.servlet.jsp.jstl.fmt.localizationContext&lt;/param-name&gt;
          &lt;param-value&gt;resources.application&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;description&gt;
          State saving method: 'client' or 'server' (=default). See JSF Specification 2.5.2&lt;/description&gt;
          &lt;param-name&gt;javax.faces.STATE_SAVING_METHOD&lt;/param-name&gt;
          &lt;param-value&gt;client&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;description&gt;
  
      This parameter tells MyFaces if javascript code should be allowed in
      the rendered HTML output.
      If javascript is allowed, command_link anchors will have javascript code
      that submits the corresponding form.
      If javascript is not allowed, the state saving info and nested parameters
      will be added as url parameters.
      Default is 'true'&lt;/description&gt;
          &lt;param-name&gt;org.apache.myfaces.ALLOW_JAVASCRIPT&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;description&gt;
  
      If true, rendered HTML code will be formatted, so that it is 'human-readable'
      i.e. additional line separators and whitespace will be written, that do not
      influence the HTML code.
      Default is 'true'&lt;/description&gt;
          &lt;param-name&gt;org.apache.myfaces.PRETTY_HTML&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;org.apache.myfaces.DETECT_JAVASCRIPT&lt;/param-name&gt;
          &lt;param-value&gt;false&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;context-param&gt;
          &lt;description&gt;
  
      If true, a javascript function will be rendered that is able to restore the
      former vertical scroll on every request. Convenient feature if you have pages
      with long lists and you do not want the browser page to always jump to the top
      if you trigger a link or button action that stays on the same page.
      Default is 'false'
  &lt;/description&gt;
          &lt;param-name&gt;org.apache.myfaces.AUTO_SCROLL&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/context-param&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.apache.shiro.web.env.EnvironmentLoaderListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;ShiroFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.shiro.web.servlet.ShiroFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;ShiroFilter&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt; 
          &lt;dispatcher&gt;FORWARD&lt;/dispatcher&gt; 
          &lt;dispatcher&gt;INCLUDE&lt;/dispatcher&gt; 
          &lt;dispatcher&gt;ERROR&lt;/dispatcher&gt;
      &lt;/filter-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;org.apache.myfaces.webapp.StartupServletContextListener&lt;/listener-class&gt;
      &lt;/listener&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
          &lt;enabled&gt;true&lt;/enabled&gt;
          &lt;async-supported&gt;false&lt;/async-supported&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/faces/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.html&lt;/welcome-file&gt;
          &lt;welcome-file&gt;index.htm&lt;/welcome-file&gt;
          &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
          &lt;welcome-file&gt;default.html&lt;/welcome-file&gt;
          &lt;welcome-file&gt;default.htm&lt;/welcome-file&gt;
          &lt;welcome-file&gt;default.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  &lt;/web-app&gt;
  </code></pre>