Shiro Logout - org.apache.shiro.session.UnknownSessionException - shiro

Question

I have currently an issue with Apache Shiro for logout:
Here my Shiro.ini
[main]
#### Session
sessionIdCookie=org.apache.shiro.web.servlet.SimpleCookie
#sessionIdCookie.path = /
sessionIdCookie.httpOnly = true
sessionIdCookie.name = sid
sessionIdCookie.domain = localhost
sessionIdCookie.maxAge=28800000
sessionIdCookie.secure = true
sessionIdCookie.sameSite = NONE
sessionManager=org.apache.shiro.web.session.mgt.DefaultWebSessionManager
sessionManager.sessionIdCookie=$sessionIdCookie
sessionManager.sessionIdCookieEnabled=true
securityManager.sessionManager=$sessionManager
# Session Timeout nach 8 Stunden
sessionManager.globalSessionTimeout= 28800000
sessionListener1= de.dpunkt.myaktion.util.MySessionListener1
sessionManager.sessionListeners=$sessionListener1
# Session validation = 5 minutes
sessionManager.sessionValidationInterval = 300000
#sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
#securityManager.sessionMode=native
sessionValidationScheduler=org.apache.shiro.session.mgt.ExecutorServiceSessionValidationScheduler
sessionValidationScheduler.interval = 60000
sessionValidationScheduler.sessionManager=$sessionManager
sessionManager.sessionValidationScheduler=$sessionValidationScheduler
sessionManager.deleteInvalidSessions=true
#sessionFactory=org.apache.shiro.session.mgt.OnlineSessionFactory
#sessionManager.sessionFactory=$sessionFactory
#securityManager.subjectDAO.sessionStorageEvaluator.sessionStorageEnabled = false
# password hashing specification, put something big for hasIterations
sha512Matcher = org.apache.shiro.authc.credential.HashedCredentialsMatcher
sha512Matcher.hashAlgorithmName=SHA-512
sha512Matcher.hashIterations=1
# Configure JDBC realm datasource.
...
# Realm for Token Login
....
# AuthStrategy
authenticator = org.apache.shiro.authc.pam.ModularRealmAuthenticator
authcStrategy = org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy
authenticator = org.apache.shiro.authc.pam.ModularRealmAuthenticator
securityManager.authenticator = $authenticator
securityManager.authenticator.authenticationStrategy = $authcStrategy
securityManager.realms = $jdbcRealm, $tcRealm
# Caching
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager
# Using default form based security filter org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authc = org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authc.loginUrl = /common/login.jsf
authc.successUrl = /portal/dashboard.jsf
# Redirect to an access denied page if user does not have access rights
#[roles]
#roles.unauthorizedUrl = /common/access-denied.jsf
#perms.unauthorizedUrl = /accessdenied.jsp
## OTHER
/WEB-INF/layout/portal/** = authc
/portal/** = authc
And here is my Controller Class:
#SessionScoped
#Named
public class LoginBean implements Serializable {
private Subject currentUserShiro;
public void logout() {
LOGGER.info("START logout");
try {
FacesContext facesContext = FacesContext.getCurrentInstance();
HttpSession httpSession = (HttpSession) facesContext.getExternalContext().getSession(false);
ServletContext application = httpSession.getServletContext();
// Shiro User
currentUserShiro.logout();
currentUserShiro = null;
FacesContext.getCurrentInstance().getExternalContext().redirect("/common/login.jsf");
}
catch (UnavailableSecurityManagerException e) {
LOGGER.info("UnavailableSecurityManagerException");
}
catch (UnknownSessionException e) {
LOGGER.info("Unknown Session");
}
catch (ExpiredSessionException e) {
LOGGER.info("Session is expired");
}
catch (StoppedSessionException e) {
LOGGER.info("Session stopped");
}
catch (NullPointerException e) {
}
catch (Exception e) {
LOGGER.error(ExceptionUtils.getFullStackTrace(e));
}
LOGGER.info("END logout");
}
After I press the logout button, I´m getting this error message:
org.apache.shiro.session.UnknownSessionException: There is no session with id [32767ef1-b285-4dc3-8
Can anybody help here? Is there anything which I haven´t considered?
It seems the logout is successful and the user is not able to go back and have the same permission, but everytime I´m getting this Exception.

Answer 1

Alright, you called the logout session on a Subject which is not known to Shiro.
To obtain the current subject, please use Subject currentUser = SecurityUtils.getSubject(); -- the same as for the login method where you call `currentUser.login( token );).
Now, with the logout method, you only need to use:
Subject currentUser = SecurityUtils.getSubject();
currentUser.logout();
... plus a try-catch.
That said, see if you can eliminate your instance field private Subject currentUserShiro. It should not be needed (at least in the code you showed us).
Reference:
https://shiro.apache.org/subject.html