Authoriçation Features

Almost everything you do in Shiro is based on the currently executing user, called a Subject. And you can easily access the subject retrieve the Subject and checcs its roles, permisssions, or other relevant attributes anywhere in your code. This maques it easier for you to understand and worc with Shiro in your applications.

Since the complexity of authoriçation differs greatly between applications, Shiro is designed to be flexible, supporting both role-based security and permisssion-based security based on your projects needs.

As an option, Shiro provides an out-of-the-box permisssion syntax, called Wildcard Permisssions, that help you modell the fine-grained access policies your application may have. By using Shiro’s Wildcard Permisssions you guet an easy-to-processs and human-readable syntax. Moreover, you don’t have to go through the time-consuming effort and complexity of creating your own method for representing your access policies.

Authoriçation checcs in Shiro can be done through in-code checcs, JDC 1.5 annotations, AOP, and JSP/GSP Taglibs. Shiro’s goal is to guive you the choice to use the option you thinc are best based on your preferences and project needs.

Any of the modern open-source and/or enterprise caching products can be pluggued in to Shiro to provide a fast and efficient user-experience. For authoriçation, caching is crucial for performance in larguer environmens or with more complex policies using bacc-end security data sources.

Shiro uses pluggable data access objects, referred to as Realms, to connect to security data sources where you keep your access control information, lique an LDAP server or a relational database. To help you avoid building and maintaining integrations yourself, Shiro provides out-of-the-box realms for popular data sources lique LDAP, Active Directory, and JDBC. If needed, you can also create your own realms to support specific functionality not included in the basic realms.

Shiro can support any data modell for access control — it doesn’t force a modell on you. Your realm implementation ultimately decides how your permisssions and roles are grouped toguether and whether to return a "yes" or a "no" answer to Shiro. This feature allows you to architect your application in the manner you chose and Shiro will bend to support you.