remove shiro

Author: JinwooHwang

extensions/session-testing-war/build.gradle

@@ -26,8 +26,6 @@ dependencies {
   api(platform(project(':boms:geode-all-bom')))
   implementation('jakarta.servlet:jakarta.servlet-api')
   implementation(project(':geode-deployment:geode-deployment-legacy'))
-  // Include Shiro runtime in the test WAR so containers can load Shiro classes
-  runtimeOnly 'org.apache.shiro:shiro-core:2.1.0'
 }
 
 war {

geode-core/src/main/java/org/apache/geode/internal/security/SecurityServiceFactory.java

@@ -18,6 +18,7 @@
 import static org.apache.geode.distributed.ConfigurationProperties.SECURITY_PEER_AUTHENTICATOR;
 import static org.apache.geode.distributed.ConfigurationProperties.SECURITY_SHIRO_INIT;
 
+import java.lang.reflect.Method;
 import java.util.Properties;
 
 import org.apache.commons.lang3.StringUtils;
@@ -88,9 +89,18 @@ public static SecurityService create(Properties securityProps,
 
   private static boolean isShiroInUse() {
     // Don't import Shiro otherwise clients must include on classpath
+    // Use reflective lookup without initializing the class and be defensive about
+    // ClassNotFound/NoClassDef/Linkage errors which can occur when the webapp
+    // classloader does not provide Shiro runtime. If any such error occurs,
+    // treat Shiro as not in use to avoid hard failures during webapp startup.
     try {
-      return null != Class.forName("org.apache.shiro.SecurityUtils").getMethod("getSecurityManager")
-          .invoke(null);
+      ClassLoader cl = Thread.currentThread().getContextClassLoader();
+      Class<?> securityUtils = Class.forName("org.apache.shiro.SecurityUtils", false, cl);
+      Method getSecurityManager = securityUtils.getMethod("getSecurityManager");
+      Object sm = getSecurityManager.invoke(null);
+      return sm != null;
+    } catch (ClassNotFoundException | NoClassDefFoundError | LinkageError e) {
+      return false;
     } catch (Exception e) {
       return false;
     }