Permission control using apache shiro

Question

I am new in apache shiro, and I read almost 60% of tutorials in apache shiro page.

It is a wonderful framework, however I wonder if it can meet my requirements.

I am interested in the permission-based authentication.

For example, to make sure if the user have the permission of delete resources, we can use this:

currentUser.isPermitted( "resource:delete" );

However in our application, even a user have the permission of delete resources, he can only delete some specified resources, not all of them.

For example(just an exmaple), the resource have an filed named createdby to record the one who create this resource.

Now user can only delete the resources created by himself if he have the resouce:delete permission.

In fact, the resources which can be deleted by the user(who have authenticated and have delete permission) will be calculated by more constraints.

Now how to make shiro work in this suitation?

David George David George · Accepted Answer · 2014-09-06T19:31:54

You can do this in Shiro but you will have to write some code. Either create a subclass of Authorizer and inject it into the security manager or create a subclass of one of the realm classes such as JdbcRealm. Then override the isPermitted method. This will need to have access to your permissions model, for example the database table or a document in a NoSQL database.

Your call to isPermitted will need to specify the resource you are deleting so you can look it up in your overridden method.

If you override the isPermitted method in the AuthorizingRealm subclass you will have access to the logged in user's principals and the user's Roles: this gives you quite a bit of flexibility because you can have says: user (principal) Fred with roles: Manager, Administrator. Your permissions model can then decide if Fred, a Manager or and Administrator can perform the task on the specified resource.

Hope that gives you some ideas.

Permission control using apache shiro

2 Answers