mark security context as deprecated and use shiro apis instead

scm-webapp/src/main/java/sonia/scm/api/rest/resources/ChangePasswordResource.java

@@ -36,7 +36,9 @@ package sonia.scm.api.rest.resources;
 //~--- non-JDK imports --------------------------------------------------------
 
 import com.google.inject.Inject;
-import com.google.inject.Provider;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
 
 import org.codehaus.enunciate.jaxrs.TypeHint;
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
@@ -46,11 +48,11 @@ import org.slf4j.LoggerFactory;
 
 import sonia.scm.api.rest.RestActionResult;
 import sonia.scm.security.EncryptionHandler;
+import sonia.scm.security.ScmSecurityException;
 import sonia.scm.user.User;
 import sonia.scm.user.UserException;
 import sonia.scm.user.UserManager;
 import sonia.scm.util.AssertUtil;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -88,13 +90,11 @@ public class ChangePasswordResource
    * @param securityContextProvider
    */
   @Inject
-  public ChangePasswordResource(
-          UserManager userManager, EncryptionHandler encryptionHandler,
-          Provider<WebSecurityContext> securityContextProvider)
+  public ChangePasswordResource(UserManager userManager,
+    EncryptionHandler encryptionHandler)
   {
     this.userManager = userManager;
     this.encryptionHandler = encryptionHandler;
-    this.securityContextProvider = securityContextProvider;
   }
 
   //~--- methods --------------------------------------------------------------
@@ -121,8 +121,8 @@ public class ChangePasswordResource
   @TypeHint(RestActionResult.class)
   @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
   public Response changePassword(@FormParam("old-password") String oldPassword,
-                                 @FormParam("new-password") String newPassword)
-          throws UserException, IOException
+    @FormParam("new-password") String newPassword)
+    throws UserException, IOException
   {
     AssertUtil.assertIsNotEmpty(oldPassword);
     AssertUtil.assertIsNotEmpty(newPassword);
@@ -135,8 +135,14 @@ public class ChangePasswordResource
     }
 
     Response response = null;
-    WebSecurityContext securityContext = securityContextProvider.get();
-    User currentUser = securityContext.getUser();
+    Subject subject = SecurityUtils.getSubject();
+
+    if (!subject.isAuthenticated())
+    {
+      throw new ScmSecurityException("user is not authenticated");
+    }
+
+    User currentUser = subject.getPrincipals().oneByType(User.class);
 
     if (logger.isInfoEnabled())
     {
@@ -178,9 +184,6 @@ public class ChangePasswordResource
   /** Field description */
   private EncryptionHandler encryptionHandler;
 
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
-
   /** Field description */
   private UserManager userManager;
 }

scm-webapp/src/main/java/sonia/scm/api/rest/resources/ConfigurationResource.java

@@ -36,15 +36,17 @@ package sonia.scm.api.rest.resources;
 //~--- non-JDK imports --------------------------------------------------------
 
 import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
+
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
 
 import sonia.scm.config.ScmConfiguration;
+import sonia.scm.security.Role;
+import sonia.scm.security.ScmSecurityException;
 import sonia.scm.util.ScmConfigurationUtil;
-import sonia.scm.util.SecurityUtil;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -76,11 +78,8 @@ public class ConfigurationResource
    * @param securityContextProvider
    */
   @Inject
-  public ConfigurationResource(
-          Provider<WebSecurityContext> securityContextProvider,
-          ScmConfiguration configuration)
+  public ConfigurationResource(ScmConfiguration configuration)
   {
-    this.securityContextProvider = securityContextProvider;
     this.configuration = configuration;
   }
 
@@ -98,7 +97,7 @@ public class ConfigurationResource
   {
     Response response = null;
 
-    if (SecurityUtil.isAdmin(securityContextProvider))
+    if (SecurityUtils.getSubject().hasRole(Role.ADMIN))
     {
       response = Response.ok(configuration).build();
     }
@@ -124,9 +123,17 @@ public class ConfigurationResource
   @POST
   @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
   public Response setConfig(@Context UriInfo uriInfo,
-                            ScmConfiguration newConfig)
+    ScmConfiguration newConfig)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+
+    // TODO replace by checkRole
+    Subject subject = SecurityUtils.getSubject();
+
+    if (!subject.hasRole(Role.ADMIN))
+    {
+      throw new ScmSecurityException("admin privileges required");
+    }
+
     configuration.load(newConfig);
 
     synchronized (ScmConfiguration.class)
@@ -141,7 +148,4 @@ public class ConfigurationResource
 
   /** Field description */
   public ScmConfiguration configuration;
-
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
 }

scm-webapp/src/main/java/sonia/scm/api/rest/resources/GroupResource.java

@@ -39,14 +39,15 @@ import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
+import org.apache.shiro.SecurityUtils;
+
 import org.codehaus.enunciate.jaxrs.TypeHint;
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
 
 import sonia.scm.group.Group;
 import sonia.scm.group.GroupException;
 import sonia.scm.group.GroupManager;
-import sonia.scm.util.SecurityUtil;
-import sonia.scm.web.security.WebSecurityContext;
+import sonia.scm.security.Role;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -77,7 +78,7 @@ import javax.ws.rs.core.UriInfo;
 @Singleton
 @ExternallyManagedLifecycle
 public class GroupResource
-        extends AbstractManagerResource<Group, GroupException>
+  extends AbstractManagerResource<Group, GroupException>
 {
 
   /** Field description */
@@ -94,11 +95,9 @@ public class GroupResource
    * @param groupManager
    */
   @Inject
-  public GroupResource(Provider<WebSecurityContext> securityContextProvider,
-                       GroupManager groupManager)
+  public GroupResource(GroupManager groupManager)
   {
     super(groupManager);
-    this.securityContextProvider = securityContextProvider;
   }
 
   //~--- methods --------------------------------------------------------------
@@ -172,7 +171,7 @@ public class GroupResource
   @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
   @Override
   public Response update(@Context UriInfo uriInfo,
-                         @PathParam("id") String name, Group group)
+    @PathParam("id") String name, Group group)
   {
     return super.update(uriInfo, name, group);
   }
@@ -205,7 +204,7 @@ public class GroupResource
   {
     Response response = null;
 
-    if (SecurityUtil.isAdmin(securityContextProvider))
+    if (SecurityUtils.getSubject().hasRole(Role.ADMIN))
     {
       response = super.get(request, id);
     }
@@ -243,7 +242,7 @@ public class GroupResource
   public Response getAll(@Context Request request, @DefaultValue("0")
   @QueryParam("start") int start, @DefaultValue("-1")
   @QueryParam("limit") int limit, @QueryParam("sortby") String sortby,
-                                  @DefaultValue("false")
+    @DefaultValue("false")
   @QueryParam("desc") boolean desc)
   {
     return super.getAll(request, start, limit, sortby, desc);
@@ -261,7 +260,7 @@ public class GroupResource
    */
   @Override
   protected GenericEntity<Collection<Group>> createGenericEntity(
-          Collection<Group> items)
+    Collection<Group> items)
   {
     return new GenericEntity<Collection<Group>>(items) {}
     ;
@@ -294,9 +293,4 @@ public class GroupResource
   {
     return PATH_PART;
   }
-
-  //~--- fields ---------------------------------------------------------------
-
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
 }

scm-webapp/src/main/java/sonia/scm/api/rest/resources/RepositoryImportResource.java

@@ -30,12 +30,12 @@
  */
 
 
+
 package sonia.scm.api.rest.resources;
 
 //~--- non-JDK imports --------------------------------------------------------
 
 import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
 import org.codehaus.enunciate.jaxrs.TypeHint;
@@ -50,7 +50,6 @@ import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryHandler;
 import sonia.scm.repository.RepositoryManager;
 import sonia.scm.util.SecurityUtil;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -93,12 +92,9 @@ public class RepositoryImportResource
    * @param securityContextProvider
    */
   @Inject
-  public RepositoryImportResource(
-          RepositoryManager manager,
-          Provider<WebSecurityContext> securityContextProvider)
+  public RepositoryImportResource(RepositoryManager manager)
   {
     this.manager = manager;
-    this.securityContextProvider = securityContextProvider;
   }
 
   //~--- methods --------------------------------------------------------------
@@ -116,9 +112,9 @@ public class RepositoryImportResource
   @TypeHint(Repository[].class)
   @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
   public GenericEntity<List<Repository>> importRepositories(
-          @PathParam("type") String type)
+    @PathParam("type") String type)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     List<Repository> repositories = new ArrayList<Repository>();
     RepositoryHandler handler = manager.getHandler(type);
@@ -143,7 +139,7 @@ public class RepositoryImportResource
             else if (logger.isWarnEnabled())
             {
               logger.warn("could not find imported repository {}",
-                          repositoryName);
+                repositoryName);
             }
           }
         }
@@ -175,7 +171,7 @@ public class RepositoryImportResource
   @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
   public GenericEntity<List<Type>> getImportableTypes()
   {
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     List<Type> types = new ArrayList<Type>();
     Collection<Type> handlerTypes = manager.getTypes();
@@ -202,7 +198,7 @@ public class RepositoryImportResource
           else if (logger.isInfoEnabled())
           {
             logger.info("{} handler does not support import of repositories",
-                        t.getName());
+              t.getName());
           }
         }
       }
@@ -220,7 +216,4 @@ public class RepositoryImportResource
 
   /** Field description */
   private RepositoryManager manager;
-
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
 }

scm-webapp/src/main/java/sonia/scm/api/rest/resources/RepositoryResource.java

@@ -38,9 +38,10 @@ package sonia.scm.api.rest.resources;
 import com.google.common.base.Strings;
 import com.google.common.io.Closeables;
 import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
+import org.apache.shiro.SecurityUtils;
+
 import org.codehaus.enunciate.jaxrs.TypeHint;
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
 
@@ -55,7 +56,6 @@ import sonia.scm.repository.Changeset;
 import sonia.scm.repository.ChangesetPagingResult;
 import sonia.scm.repository.Permission;
 import sonia.scm.repository.PermissionType;
-import sonia.scm.repository.PermissionUtil;
 import sonia.scm.repository.Repository;
 import sonia.scm.repository.RepositoryException;
 import sonia.scm.repository.RepositoryIsNotArchivedException;
@@ -71,10 +71,10 @@ import sonia.scm.repository.api.DiffCommandBuilder;
 import sonia.scm.repository.api.LogCommandBuilder;
 import sonia.scm.repository.api.RepositoryService;
 import sonia.scm.repository.api.RepositoryServiceFactory;
+import sonia.scm.security.RepositoryPermission;
 import sonia.scm.security.ScmSecurityException;
 import sonia.scm.util.AssertUtil;
 import sonia.scm.util.Util;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -137,14 +137,12 @@ public class RepositoryResource
   @Inject
   public RepositoryResource(ScmConfiguration configuration,
     RepositoryManager repositoryManager,
-    Provider<WebSecurityContext> securityContextProvider,
     RepositoryServiceFactory servicefactory)
   {
     super(repositoryManager);
     this.configuration = configuration;
     this.repositoryManager = repositoryManager;
     this.servicefactory = servicefactory;
-    this.securityContextProvider = securityContextProvider;
     setDisableCache(false);
   }
 
@@ -1091,8 +1089,9 @@ public class RepositoryResource
    */
   private boolean isOwner(Repository repository)
   {
-    return PermissionUtil.hasPermission(repository, securityContextProvider,
-      PermissionType.OWNER);
+
+    return SecurityUtils.getSubject().isPermitted(
+      new RepositoryPermission(repository, PermissionType.OWNER));
   }
 
   //~--- fields ---------------------------------------------------------------
@@ -1103,9 +1102,6 @@ public class RepositoryResource
   /** Field description */
   private RepositoryManager repositoryManager;
 
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
-
   /** Field description */
   private RepositoryServiceFactory servicefactory;
 }

scm-webapp/src/main/java/sonia/scm/api/rest/resources/SearchResource.java

@@ -37,7 +37,6 @@ package sonia.scm.api.rest.resources;
 
 import com.google.common.base.Function;
 import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
@@ -54,7 +53,6 @@ import sonia.scm.search.SearchResults;
 import sonia.scm.user.User;
 import sonia.scm.user.UserListener;
 import sonia.scm.user.UserManager;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -92,9 +90,8 @@ public class SearchResource implements UserListener, GroupListener
    * @param cacheManager
    */
   @Inject
-  public SearchResource(Provider<WebSecurityContext> securityContextProvider,
-                        UserManager userManager, GroupManager groupManager,
-                        CacheManager cacheManager)
+  public SearchResource(UserManager userManager, GroupManager groupManager,
+    CacheManager cacheManager)
   {
 
     // create user searchhandler
@@ -103,8 +100,7 @@ public class SearchResource implements UserListener, GroupListener
     Cache<String, SearchResults> userCache =
       cacheManager.getCache(String.class, SearchResults.class, CACHE_USER);
 
-    this.userSearchHandler = new SearchHandler<User>(securityContextProvider,
-            userCache, userManager);
+    this.userSearchHandler = new SearchHandler<User>(userCache, userManager);
 
     // create group searchhandler
     groupManager.addListener(this);
@@ -112,8 +108,8 @@ public class SearchResource implements UserListener, GroupListener
     Cache<String, SearchResults> groupCache =
       cacheManager.getCache(String.class, SearchResults.class, CACHE_GROUP);
 
-    this.groupSearchHandler = new SearchHandler<Group>(securityContextProvider,
-            groupCache, groupManager);
+    this.groupSearchHandler = new SearchHandler<Group>(groupCache,
+      groupManager);
   }
 
   //~--- methods --------------------------------------------------------------
@@ -162,7 +158,7 @@ public class SearchResource implements UserListener, GroupListener
   public SearchResults searchGroups(@QueryParam("query") String queryString)
   {
     return groupSearchHandler.search(queryString,
-                                     new Function<Group, SearchResult>()
+      new Function<Group, SearchResult>()
     {
       @Override
       public SearchResult apply(Group group)
@@ -198,7 +194,7 @@ public class SearchResource implements UserListener, GroupListener
   public SearchResults searchUsers(@QueryParam("query") String queryString)
   {
     return userSearchHandler.search(queryString,
-                                    new Function<User, SearchResult>()
+      new Function<User, SearchResult>()
     {
       @Override
       public SearchResult apply(User user)

scm-webapp/src/main/java/sonia/scm/api/rest/resources/SupportResource.java

@@ -39,6 +39,9 @@ import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
 import com.google.inject.Inject;
 
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
+
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
 
 import sonia.scm.SCMContextProvider;
@@ -47,10 +50,10 @@ import sonia.scm.config.ScmConfiguration;
 import sonia.scm.plugin.PluginManager;
 import sonia.scm.repository.RepositoryHandler;
 import sonia.scm.repository.RepositoryManager;
+import sonia.scm.security.Role;
+import sonia.scm.security.ScmSecurityException;
 import sonia.scm.store.StoreFactory;
-import sonia.scm.util.SecurityUtil;
 import sonia.scm.util.SystemUtil;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -96,12 +99,10 @@ public class SupportResource
    * @param repositoryManager
    */
   @Inject
-  public SupportResource(WebSecurityContext securityContext,
-    SCMContextProvider context, ScmConfiguration configuration,
-    PluginManager pluginManager, StoreFactory storeFactory,
-    RepositoryManager repositoryManager)
+  public SupportResource(SCMContextProvider context,
+    ScmConfiguration configuration, PluginManager pluginManager,
+    StoreFactory storeFactory, RepositoryManager repositoryManager)
   {
-    this.securityContext = securityContext;
     this.context = context;
     this.configuration = configuration;
     this.pluginManager = pluginManager;
@@ -123,7 +124,12 @@ public class SupportResource
   @Produces(MediaType.TEXT_HTML)
   public Viewable getSupport() throws IOException
   {
-    SecurityUtil.assertIsAdmin(securityContext);
+    Subject subject = SecurityUtils.getSubject();
+
+    if (!subject.hasRole(Role.ADMIN))
+    {
+      throw new ScmSecurityException("admin privileges required");
+    }
 
     Map<String, Object> env = Maps.newHashMap();
 
@@ -445,9 +451,6 @@ public class SupportResource
   /** Field description */
   private RepositoryManager repositoryManager;
 
-  /** Field description */
-  private WebSecurityContext securityContext;
-
   /** Field description */
   private Class<?> storeFactoryClass;
 }

scm-webapp/src/main/java/sonia/scm/api/rest/resources/UserResource.java

@@ -36,20 +36,20 @@ package sonia.scm.api.rest.resources;
 //~--- non-JDK imports --------------------------------------------------------
 
 import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
+import org.apache.shiro.SecurityUtils;
+
 import org.codehaus.enunciate.jaxrs.TypeHint;
 import org.codehaus.enunciate.modules.jersey.ExternallyManagedLifecycle;
 
 import sonia.scm.security.EncryptionHandler;
+import sonia.scm.security.Role;
 import sonia.scm.user.User;
 import sonia.scm.user.UserException;
 import sonia.scm.user.UserManager;
 import sonia.scm.util.AssertUtil;
-import sonia.scm.util.SecurityUtil;
 import sonia.scm.util.Util;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -100,12 +100,10 @@ public class UserResource extends AbstractManagerResource<User, UserException>
    */
   @Inject
   public UserResource(UserManager userManager,
-                      EncryptionHandler encryptionHandler,
-                      Provider<WebSecurityContext> securityContextProvider)
+    EncryptionHandler encryptionHandler)
   {
     super(userManager);
     this.encryptionHandler = encryptionHandler;
-    this.securityContextProvider = securityContextProvider;
   }
 
   //~--- methods --------------------------------------------------------------
@@ -179,7 +177,7 @@ public class UserResource extends AbstractManagerResource<User, UserException>
   @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
   @Override
   public Response update(@Context UriInfo uriInfo,
-                         @PathParam("id") String name, User user)
+    @PathParam("id") String name, User user)
   {
     return super.update(uriInfo, name, user);
   }
@@ -212,7 +210,7 @@ public class UserResource extends AbstractManagerResource<User, UserException>
   {
     Response response = null;
 
-    if (SecurityUtil.isAdmin(securityContextProvider))
+    if (SecurityUtils.getSubject().hasRole(Role.ADMIN))
     {
       response = super.get(request, id);
     }
@@ -250,7 +248,7 @@ public class UserResource extends AbstractManagerResource<User, UserException>
   public Response getAll(@Context Request request, @DefaultValue("0")
   @QueryParam("start") int start, @DefaultValue("-1")
   @QueryParam("limit") int limit, @QueryParam("sortby") String sortby,
-                                  @DefaultValue("false")
+    @DefaultValue("false")
   @QueryParam("desc") boolean desc)
   {
     return super.getAll(request, start, limit, sortby, desc);
@@ -268,7 +266,7 @@ public class UserResource extends AbstractManagerResource<User, UserException>
    */
   @Override
   protected GenericEntity<Collection<User>> createGenericEntity(
-          Collection<User> items)
+    Collection<User> items)
   {
     return new GenericEntity<Collection<User>>(items) {}
     ;
@@ -396,7 +394,4 @@ public class UserResource extends AbstractManagerResource<User, UserException>
 
   /** Field description */
   private EncryptionHandler encryptionHandler;
-
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
 }

scm-webapp/src/main/java/sonia/scm/filter/AdminSecurityFilter.java

@@ -35,12 +35,11 @@ package sonia.scm.filter;
 
 //~--- non-JDK imports --------------------------------------------------------
 
-import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
-import sonia.scm.util.SecurityUtil;
-import sonia.scm.web.security.WebSecurityContext;
+import org.apache.shiro.subject.Subject;
+
+import sonia.scm.security.Role;
 
 /**
  *
@@ -50,32 +49,19 @@ import sonia.scm.web.security.WebSecurityContext;
 public class AdminSecurityFilter extends SecurityFilter
 {
 
-  /**
-   * Constructs ...
-   *
-   *
-   * @param securityContextProvider
-   */
-  @Inject
-  public AdminSecurityFilter(
-          Provider<WebSecurityContext> securityContextProvider)
-  {
-    super(securityContextProvider);
-  }
-
-  //~--- get methods ----------------------------------------------------------
-
   /**
    * Method description
    *
    *
    * @param securityContext
    *
+   * @param subject
+   *
    * @return
    */
   @Override
-  protected boolean hasPermission(WebSecurityContext securityContext)
+  protected boolean hasPermission(Subject subject)
   {
-    return SecurityUtil.isAdmin(securityContext);
+    return subject.hasRole(Role.ADMIN);
   }
 }

scm-webapp/src/main/java/sonia/scm/filter/SecurityFilter.java

@@ -35,13 +35,14 @@ package sonia.scm.filter;
 
 //~--- non-JDK imports --------------------------------------------------------
 
-import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
+
+import sonia.scm.user.User;
 import sonia.scm.web.filter.HttpFilter;
 import sonia.scm.web.filter.SecurityHttpServletRequestWrapper;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -63,20 +64,6 @@ public class SecurityFilter extends HttpFilter
   /** Field description */
   public static final String URL_AUTHENTICATION = "/api/rest/authentication";
 
-  //~--- constructors ---------------------------------------------------------
-
-  /**
-   * Constructs ...
-   *
-   *
-   * @param securityContextProvider
-   */
-  @Inject
-  public SecurityFilter(Provider<WebSecurityContext> securityContextProvider)
-  {
-    this.securityContextProvider = securityContextProvider;
-  }
-
   //~--- methods --------------------------------------------------------------
 
   /**
@@ -92,40 +79,29 @@ public class SecurityFilter extends HttpFilter
    */
   @Override
   protected void doFilter(HttpServletRequest request,
-                          HttpServletResponse response, FilterChain chain)
-          throws IOException, ServletException
+    HttpServletResponse response, FilterChain chain)
+    throws IOException, ServletException
   {
-    WebSecurityContext securityContext = securityContextProvider.get();
+    Subject subject = SecurityUtils.getSubject();
 
-    if (securityContext != null)
+    String uri =
+      request.getRequestURI().substring(request.getContextPath().length());
+
+    if (!uri.startsWith(URL_AUTHENTICATION))
     {
-      String uri =
-        request.getRequestURI().substring(request.getContextPath().length());
-
-      if (!uri.startsWith(URL_AUTHENTICATION))
+      if (hasPermission(subject))
       {
-        if (hasPermission(securityContext))
-        {
-          chain.doFilter(new SecurityHttpServletRequestWrapper(request,
-                  securityContext.getUser()), response);
-        }
-        else if (securityContext.isAuthenticated())
-        {
-          response.sendError(HttpServletResponse.SC_FORBIDDEN);
-        }
-        else
-        {
-          response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
-        }
+        chain.doFilter(new SecurityHttpServletRequestWrapper(request,
+          subject.getPrincipals().oneByType(User.class)), response);
       }
       else
       {
-        chain.doFilter(request, response);
+        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
       }
     }
     else
     {
-      response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+      chain.doFilter(request, response);
     }
   }
 
@@ -135,17 +111,12 @@ public class SecurityFilter extends HttpFilter
    * Method description
    *
    *
-   * @param securityContext
+   * @param subject
    *
    * @return
    */
-  protected boolean hasPermission(WebSecurityContext securityContext)
+  protected boolean hasPermission(Subject subject)
   {
-    return securityContext.isAuthenticated();
+    return subject.isAuthenticated();
   }
-
-  //~--- fields ---------------------------------------------------------------
-
-  /** Field description */
-  private Provider<WebSecurityContext> securityContextProvider;
 }

scm-webapp/src/main/java/sonia/scm/group/DefaultGroupManager.java

@@ -47,7 +47,6 @@ import sonia.scm.SCMContextProvider;
 import sonia.scm.TransformFilter;
 import sonia.scm.search.SearchRequest;
 import sonia.scm.search.SearchUtil;
-import sonia.scm.security.SecurityContext;
 import sonia.scm.util.CollectionAppender;
 import sonia.scm.util.SecurityUtil;
 import sonia.scm.util.Util;
@@ -87,11 +86,9 @@ public class DefaultGroupManager extends AbstractGroupManager
    * @param groupListenerProvider
    */
   @Inject
-  public DefaultGroupManager(Provider<SecurityContext> securityContextProvider,
-                             GroupDAO groupDAO,
+  public DefaultGroupManager(GroupDAO groupDAO,
                              Provider<Set<GroupListener>> groupListenerProvider)
   {
-    this.securityContextProvider = securityContextProvider;
     this.groupDAO = groupDAO;
     this.groupListenerProvider = groupListenerProvider;
   }
@@ -136,7 +133,7 @@ public class DefaultGroupManager extends AbstractGroupManager
                   group.getType());
     }
 
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     if (groupDAO.contains(group.getName()))
     {
@@ -167,7 +164,7 @@ public class DefaultGroupManager extends AbstractGroupManager
                   group.getType());
     }
 
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     String name = group.getName();
 
@@ -218,7 +215,7 @@ public class DefaultGroupManager extends AbstractGroupManager
                   group.getType());
     }
 
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     String name = group.getName();
 
@@ -253,7 +250,7 @@ public class DefaultGroupManager extends AbstractGroupManager
                   group.getType());
     }
 
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     Group fresh = groupDAO.get(group.getName());
 
@@ -346,7 +343,7 @@ public class DefaultGroupManager extends AbstractGroupManager
   @Override
   public Collection<Group> getAll(Comparator<Group> comparator)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     List<Group> groups = new ArrayList<Group>();
 
@@ -378,7 +375,7 @@ public class DefaultGroupManager extends AbstractGroupManager
   public Collection<Group> getAll(Comparator<Group> comparator, int start,
                                   int limit)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     return Util.createSubCollection(groupDAO.getAll(), comparator,
                                     new CollectionAppender<Group>()
@@ -449,7 +446,4 @@ public class DefaultGroupManager extends AbstractGroupManager
 
   /** Field description */
   private Provider<Set<GroupListener>> groupListenerProvider;
-
-  /** Field description */
-  private Provider<SecurityContext> securityContextProvider;
 }

scm-webapp/src/main/java/sonia/scm/plugin/DefaultPluginManager.java

@@ -50,7 +50,6 @@ import sonia.scm.cache.Cache;
 import sonia.scm.cache.CacheManager;
 import sonia.scm.config.ScmConfiguration;
 import sonia.scm.net.HttpClient;
-import sonia.scm.security.SecurityContext;
 import sonia.scm.util.AssertUtil;
 import sonia.scm.util.IOUtil;
 import sonia.scm.util.SecurityUtil;
@@ -82,7 +81,7 @@ import javax.xml.bind.Unmarshaller;
  */
 @Singleton
 public class DefaultPluginManager
-        implements PluginManager, ConfigChangedListener<ScmConfiguration>
+  implements PluginManager, ConfigChangedListener<ScmConfiguration>
 {
 
   /** Field description */
@@ -116,17 +115,14 @@ public class DefaultPluginManager
    * @param clientProvider
    */
   @Inject
-  public DefaultPluginManager(
-          SCMContextProvider context,
-          Provider<SecurityContext> securityContextProvicer,
-          ScmConfiguration configuration, PluginLoader pluginLoader,
-          CacheManager cacheManager, Provider<HttpClient> clientProvider)
+  public DefaultPluginManager(SCMContextProvider context,
+    ScmConfiguration configuration, PluginLoader pluginLoader,
+    CacheManager cacheManager, Provider<HttpClient> clientProvider)
   {
     this.context = context;
-    this.securityContextProvicer = securityContextProvicer;
     this.configuration = configuration;
     this.cache = cacheManager.getCache(String.class, PluginCenter.class,
-                                       CACHE_NAME);
+      CACHE_NAME);
     this.clientProvider = clientProvider;
     installedPlugins = new HashMap<String, Plugin>();
 
@@ -191,7 +187,7 @@ public class DefaultPluginManager
   @Override
   public void install(String id)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     PluginCenter center = getPluginCenter();
 
@@ -223,7 +219,7 @@ public class DefaultPluginManager
   @Override
   public void uninstall(String id)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     Plugin plugin = installedPlugins.get(id);
 
@@ -267,7 +263,7 @@ public class DefaultPluginManager
   @Override
   public void update(String id)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     String[] idParts = id.split(":");
     String groupId = idParts[0];
@@ -277,7 +273,7 @@ public class DefaultPluginManager
     for (PluginInformation info : getInstalled())
     {
       if (groupId.equals(info.getGroupId())
-          && artefactId.equals(info.getArtifactId()))
+        && artefactId.equals(info.getArtifactId()))
       {
         installed = info;
 
@@ -311,7 +307,7 @@ public class DefaultPluginManager
   @Override
   public PluginInformation get(String id)
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     PluginInformation result = null;
 
@@ -340,7 +336,7 @@ public class DefaultPluginManager
   public Set<PluginInformation> get(PluginFilter filter)
   {
     AssertUtil.assertIsNotNull(filter);
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     Set<PluginInformation> infoSet = new HashSet<PluginInformation>();
 
@@ -359,7 +355,7 @@ public class DefaultPluginManager
   @Override
   public Collection<PluginInformation> getAll()
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     Set<PluginInformation> infoSet = getInstalled();
 
@@ -377,7 +373,7 @@ public class DefaultPluginManager
   @Override
   public Collection<PluginInformation> getAvailable()
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     Set<PluginInformation> availablePlugins = new HashSet<PluginInformation>();
     Set<PluginInformation> centerPlugins = getPluginCenter().getPlugins();
@@ -402,7 +398,7 @@ public class DefaultPluginManager
   @Override
   public Set<PluginInformation> getAvailableUpdates()
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     return get(FILTER_UPDATES);
   }
@@ -416,7 +412,7 @@ public class DefaultPluginManager
   @Override
   public Set<PluginInformation> getInstalled()
   {
-    SecurityUtil.assertIsAdmin(securityContextProvicer);
+    SecurityUtil.assertIsAdmin();
 
     Set<PluginInformation> infoSet = new LinkedHashSet<PluginInformation>();
 
@@ -453,7 +449,7 @@ public class DefaultPluginManager
     }
 
     return url.replace("{version}", context.getVersion()).replace("{os}",
-                       os).replace("{arch}", arch);
+      os).replace("{arch}", arch);
   }
 
   /**
@@ -465,7 +461,7 @@ public class DefaultPluginManager
    * @param filter
    */
   private void filter(Set<PluginInformation> target,
-                      Collection<PluginInformation> source, PluginFilter filter)
+    Collection<PluginInformation> source, PluginFilter filter)
   {
     for (PluginInformation info : source)
     {
@@ -588,7 +584,7 @@ public class DefaultPluginManager
             if (pluginHandler == null)
             {
               pluginHandler = new AetherPluginHandler(this,
-                      SCMContext.getContext(), configuration);
+                SCMContext.getContext(), configuration);
             }
 
             pluginHandler.setPluginRepositories(center.getRepositories());
@@ -643,7 +639,7 @@ public class DefaultPluginManager
       PluginInformation installed = installedPlugin.getInformation();
 
       if (isSamePlugin(available, installed)
-          && (installed.getState() == PluginState.CORE))
+        && (installed.getState() == PluginState.CORE))
       {
         core = true;
 
@@ -664,7 +660,7 @@ public class DefaultPluginManager
    * @return
    */
   private boolean isNewer(PluginInformation available,
-                          PluginInformation installed)
+    PluginInformation installed)
   {
     boolean result = false;
     PluginVersion version = PluginVersion.createVersion(available.getVersion());
@@ -689,7 +685,7 @@ public class DefaultPluginManager
   private boolean isSamePlugin(PluginInformation p1, PluginInformation p2)
   {
     return p1.getGroupId().equals(p2.getGroupId())
-           && p1.getArtifactId().equals(p2.getArtifactId());
+      && p1.getArtifactId().equals(p2.getArtifactId());
   }
 
   //~--- fields ---------------------------------------------------------------
@@ -712,9 +708,6 @@ public class DefaultPluginManager
   /** Field description */
   private AetherPluginHandler pluginHandler;
 
-  /** Field description */
-  private Provider<SecurityContext> securityContextProvicer;
-
   /** Field description */
   private Unmarshaller unmarshaller;
 }

scm-webapp/src/main/java/sonia/scm/search/SearchHandler.java

@@ -37,15 +37,16 @@ package sonia.scm.search;
 
 import com.google.common.base.Function;
 import com.google.common.collect.Collections2;
-import com.google.inject.Provider;
+
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import sonia.scm.cache.Cache;
-import sonia.scm.util.SecurityUtil;
+import sonia.scm.security.ScmSecurityException;
 import sonia.scm.util.Util;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -77,11 +78,10 @@ public class SearchHandler<T>
    * @param cache
    * @param searchable
    */
-  public SearchHandler(Provider<WebSecurityContext> securityContextProvider,
-                       Cache<String, SearchResults> cache,
-                       Searchable<T> searchable)
+  public SearchHandler(Cache<String, SearchResults> cache,
+    Searchable<T> searchable)
   {
-    this.securityContextProvider = securityContextProvider;
+
     this.cache = cache;
     this.searchable = searchable;
   }
@@ -107,9 +107,14 @@ public class SearchHandler<T>
    * @return
    */
   public SearchResults search(String queryString,
-                              Function<T, SearchResult> function)
+    Function<T, SearchResult> function)
   {
-    SecurityUtil.assertIsNotAnonymous(securityContextProvider);
+    Subject subject = SecurityUtils.getSubject();
+
+    if (!subject.isAuthenticated())
+    {
+      throw new ScmSecurityException("Authentication is required");
+    }
 
     if (Util.isEmpty(queryString))
     {
@@ -202,9 +207,6 @@ public class SearchHandler<T>
   /** Field description */
   protected Searchable<T> searchable;
 
-  /** Field description */
-  protected Provider<WebSecurityContext> securityContextProvider;
-
   /** Field description */
   private int maxResults = 5;
 

scm-webapp/src/main/java/sonia/scm/user/DefaultUserManager.java

@@ -39,6 +39,9 @@ import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
+
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -47,13 +50,13 @@ import sonia.scm.SCMContextProvider;
 import sonia.scm.TransformFilter;
 import sonia.scm.search.SearchRequest;
 import sonia.scm.search.SearchUtil;
+import sonia.scm.security.Role;
 import sonia.scm.security.ScmSecurityException;
 import sonia.scm.util.AssertUtil;
 import sonia.scm.util.CollectionAppender;
 import sonia.scm.util.IOUtil;
 import sonia.scm.util.SecurityUtil;
 import sonia.scm.util.Util;
-import sonia.scm.web.security.WebSecurityContext;
 
 //~--- JDK imports ------------------------------------------------------------
 
@@ -104,11 +107,9 @@ public class DefaultUserManager extends AbstractUserManager
    * @param userListenerProvider
    */
   @Inject
-  public DefaultUserManager(
-          Provider<WebSecurityContext> scurityContextProvider, UserDAO userDAO,
-          Provider<Set<UserListener>> userListenerProvider)
+  public DefaultUserManager(UserDAO userDAO,
+    Provider<Set<UserListener>> userListenerProvider)
   {
-    this.scurityContextProvider = scurityContextProvider;
     this.userDAO = userDAO;
     this.userListenerProvider = userListenerProvider;
   }
@@ -166,9 +167,16 @@ public class DefaultUserManager extends AbstractUserManager
       logger.info("create user {} of type {}", user.getName(), user.getType());
     }
 
-    User currentUser = SecurityUtil.getCurrentUser(scurityContextProvider);
+    Subject subject = SecurityUtils.getSubject();
 
-    if (!user.equals(currentUser) &&!currentUser.isAdmin())
+    if (!subject.isAuthenticated())
+    {
+      throw new ScmSecurityException("user is not authenticated");
+    }
+
+    User currentUser = subject.getPrincipals().oneByType(User.class);
+
+    if (!user.equals(currentUser) &&!subject.hasRole(Role.ADMIN))
     {
       throw new ScmSecurityException("admin account is required");
     }
@@ -202,7 +210,7 @@ public class DefaultUserManager extends AbstractUserManager
       logger.info("delete user {} of type {}", user.getName(), user.getType());
     }
 
-    SecurityUtil.assertIsAdmin(scurityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     String name = user.getName();
 
@@ -259,9 +267,17 @@ public class DefaultUserManager extends AbstractUserManager
       logger.info("modify user {} of type {}", user.getName(), user.getType());
     }
 
-    User currentUser = SecurityUtil.getCurrentUser(scurityContextProvider);
+    Subject subject = SecurityUtils.getSubject();
 
-    if (!user.getName().equals(currentUser.getName()) &&!currentUser.isAdmin())
+    if (!subject.isAuthenticated())
+    {
+      throw new ScmSecurityException("user is not authenticated");
+    }
+
+    User currentUser = subject.getPrincipals().oneByType(User.class);
+
+    if (!user.getName().equals(currentUser.getName())
+      &&!subject.hasRole(Role.ADMIN))
     {
       throw new ScmSecurityException("admin account is required");
     }
@@ -299,7 +315,7 @@ public class DefaultUserManager extends AbstractUserManager
       logger.info("refresh user {} of type {}", user.getName(), user.getType());
     }
 
-    SecurityUtil.assertIsAdmin(scurityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     User fresh = userDAO.get(user.getName());
 
@@ -328,7 +344,7 @@ public class DefaultUserManager extends AbstractUserManager
     }
 
     return SearchUtil.search(searchRequest, userDAO.getAll(),
-                             new TransformFilter<User>()
+      new TransformFilter<User>()
     {
       @Override
       public User accept(User user)
@@ -336,7 +352,7 @@ public class DefaultUserManager extends AbstractUserManager
         User result = null;
 
         if (SearchUtil.matchesOne(searchRequest, user.getName(),
-                                  user.getDisplayName(), user.getMail()))
+          user.getDisplayName(), user.getMail()))
         {
           result = user.clone();
         }
@@ -394,7 +410,7 @@ public class DefaultUserManager extends AbstractUserManager
   @Override
   public Collection<User> getAll(Comparator<User> comparator)
   {
-    SecurityUtil.assertIsAdmin(scurityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     List<User> users = new ArrayList<User>();
 
@@ -424,12 +440,12 @@ public class DefaultUserManager extends AbstractUserManager
    */
   @Override
   public Collection<User> getAll(Comparator<User> comaparator, int start,
-                                 int limit)
+    int limit)
   {
-    SecurityUtil.assertIsAdmin(scurityContextProvider);
+    SecurityUtil.assertIsAdmin();
 
     return Util.createSubCollection(userDAO.getAll(), comaparator,
-                                    new CollectionAppender<User>()
+      new CollectionAppender<User>()
     {
       @Override
       public void append(Collection<User> collection, User item)
@@ -531,9 +547,6 @@ public class DefaultUserManager extends AbstractUserManager
 
   //~--- fields ---------------------------------------------------------------
 
-  /** Field description */
-  private Provider<WebSecurityContext> scurityContextProvider;
-
   /** Field description */
   private UserDAO userDAO;
 

scm-webapp/src/main/java/sonia/scm/web/security/ApiBasicAuthenticationFilter.java

@@ -35,8 +35,6 @@ package sonia.scm.web.security;
 
 //~--- non-JDK imports --------------------------------------------------------
 
-import com.google.inject.Inject;
-import com.google.inject.Provider;
 import com.google.inject.Singleton;
 
 import sonia.scm.web.filter.BasicAuthenticationFilter;
@@ -67,21 +65,6 @@ public class ApiBasicAuthenticationFilter extends BasicAuthenticationFilter
   /** Field description */
   public static final String URI_STATE = "/api/rest/authentication/state";
 
-  //~--- constructors ---------------------------------------------------------
-
-  /**
-   * Constructs ...
-   *
-   *
-   * @param securityContextProvider
-   */
-  @Inject
-  public ApiBasicAuthenticationFilter(
-          Provider<WebSecurityContext> securityContextProvider)
-  {
-    super(securityContextProvider);
-  }
-
   //~--- methods --------------------------------------------------------------
 
   /**
@@ -97,14 +80,14 @@ public class ApiBasicAuthenticationFilter extends BasicAuthenticationFilter
    */
   @Override
   protected void doFilter(HttpServletRequest request,
-                          HttpServletResponse response, FilterChain chain)
-          throws IOException, ServletException
+    HttpServletResponse response, FilterChain chain)
+    throws IOException, ServletException
   {
 
     // skip filter on authentication resource
     if (request.getRequestURI().contains(URI_LOGIN)
-        || request.getRequestURI().contains(URI_STATE)
-        || request.getRequestURI().contains(URI_LOGOUT))
+      || request.getRequestURI().contains(URI_STATE)
+      || request.getRequestURI().contains(URI_LOGOUT))
     {
       chain.doFilter(request, response);
     }
@@ -127,9 +110,8 @@ public class ApiBasicAuthenticationFilter extends BasicAuthenticationFilter
    */
   @Override
   protected void handleUnauthorized(HttpServletRequest request,
-                                    HttpServletResponse response,
-                                    FilterChain chain)
-          throws IOException, ServletException
+    HttpServletResponse response, FilterChain chain)
+    throws IOException, ServletException
   {
     chain.doFilter(request, response);
   }

scm-webapp/src/main/java/sonia/scm/web/security/SecurityUtil.java

@@ -42,7 +42,9 @@ import sonia.scm.SCMContext;
 /**
  *
  * @author Sebastian Sdorra
+ * @deprecated 
  */
+@Deprecated
 public class SecurityUtil
 {