We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some will be authenticated using JDBC, but all users will be authorized using JDBC.
Shiro has proven up to the task, but not well. It does work, but only sometimes. The programmatic realms I've created don't seem to run the same way each time. Sometimes when attempting logins several times it will fail, only to eventually succeed. This is the exact same request with the exact same data. Debugging shows that sometimes it simply doesn't call the necessary functions to get the authentication or authorization data. Restarting the instance will usually fix this, but only for a time. It also seems to have a serious problems with multiple shiro applications existing on the same Glassfish instance.
As such, Shiro seems to be not be tenable choice especially given how little documentation exists for it. I am already overriding Shiro's methods to tell it exactly how to get the data, so I'd like to simply code my own java user authentication classes.
Currently the best argument I've heard against this is that a custom-coded system will not be as secure as an industry standard one. However from what I've read online and been taught in class, most hacking attempts focus on gaining access to usernames and passwords, or figuring out how to send rouge code into the system. Most methods don't actually breach the software itself; it basically just checks whatever data is provided and as long as all inputs are sanitized the user authentication software itself isn't usually the problem. Is that assessment accurate?
Also, are there any pitfalls I should be aware of? I understand there are other options like Spring Security or JAAS but since I already essentially have the system I need built inside Shiro and only have to remove it from that software, it seems to be the best option would be to use that at this point in the development cycle.