Apache Shiro IncorrectCredentialsException

Question

This is my first time using apache shiro, so bear with me.

my shiro.ini

#   =============================================================================
# Quickstart INI Realm configuration
#
# =============================================================================
[main]
jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.permissionsLookupEnabled = true
ds = shiro.ShiroBoneCPDataSource
jdbcRealm.dataSource=$ds 
jdbcRealm.authenticationQuery = SELECT password FROM users WHERE username = ?
jdbcRealm.userRolesQuery = SELECT role_id FROM user_role WHERE user_id = (SELECT id FROM users WHERE username = ?)
jdbcRealm.permissionsQuery = SELECT permission FROM role_permission WHERE role_id = ?



hashService = org.apache.shiro.crypto.hash.DefaultHashService
# NONE of the hashService settings is required.  The defaults will work fine.

hashService.hashAlgorithmName = SHA-256
hashService.generatePublicSalt = true
# If you wanted to use some private salt bytes, provide in Base64 (NOT A BAD IDEA!)
hashService.privateSalt = aGltYWxheWFu

# We use this one to create a new test user with a hashed password.
passwordService = org.apache.shiro.authc.credential.DefaultPasswordService
passwordService.hashService = $hashService

# We use this for our authentication tests.
passwordMatcher = org.apache.shiro.authc.credential.PasswordMatcher
passwordMatcher.passwordService = $passwordService
jdbcRealm.credentialsMatcher = $passwordMatcher

securityManager.realms = $jdbcRealm
# -----------------------------------------------------------------------------
# Users and their assigned roles
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions JavaDoc
#   -----------------------------------------------------------------------------
[users]


# -----------------------------------------------------------------------------
# Roles with assigned permissions
# 
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc
# -----------------------------------------------------------------------------
[roles]

I use this shiro.ini file here

public Subject authenticateWithShiro(String username, char[] pass) {

    Subject currentUser = null;
    try {
            log.info("Authentication with shiro is started...");

            Factory<org.apache.shiro.mgt.SecurityManager> factory = new IniSecurityManagerFactory(
                            "classpath:resources/shiro.ini");
            org.apache.shiro.mgt.SecurityManager securityManager = factory
                            .getInstance();
            SecurityUtils.setSecurityManager(securityManager);

            currentUser = SecurityUtils.getSubject();

            Session session = currentUser.getSession();
            session.setAttribute("someKey", "aValue");
            String value = (String) session.getAttribute("someKey");
            if (value.equals("aValue")) {
                    log.info("Retrieved the correct value! [" + value + "]");
            }

            // let's login the current user so we can check against roles and
            // permissions:
            if (!currentUser.isAuthenticated()) {
                System.out.println("Current user has been authenticated.");
                    UsernamePasswordToken token = new UsernamePasswordToken(
                                    username, pass);
                    token.setRememberMe(true);
                    currentUser.login(token);

            }
    } catch (Exception e) {
            log.error("Authentication failed", e);
            log.error(e.getMessage());
    }

    return currentUser;
   }

So, when executing below code, org.apache.shiro.authc.IncorrectCredentialsException: Submitted credentials for token [org.apache.shiro.authc.UsernamePasswordToken - yunusa, rememberMe=true] did not match the expected credentials

Subject subject = new UserHandler().authenticateWithShiro(username, textPassword.getPassword());
        if (subject != null && subject.isAuthenticated()) {
                System.out.println("successfull login");
        } else {
                System.out.println("Failed log in");
        }

Answer 1

I am also new to shiro. I believe you probably missed adding the Auth token information in your ini file. Add:

yourID = passWord

Under [users] section.

Hope it helps!

Answer 2

After so much time trying to go through stackoverflow questions in search of an answer without any success, i finally decided to go through my INI(shiro.ini) and found a minor mistake. I initially set hashService.generatePublicSalt to true, and the same time configured private salt, which seemed to be a mistake.

When i remove the private salt, everything worked like a charm.