I am trying to build a dynamic Allowance/Permission with Apache Shiro using JPA datasource.
In the very end, everithing goes back to this class:
public class CustomAuthorizationFilter extends HttpMethodPermissionFilter {
@Override
public boolean isAccessAllowed(ServletRequest r, ServletResponse r, Object m) throws IOException {
//Somehow get the user stored somewhere in the servlet memory
SysUser loggedUser = %some_code_here%
for (String allowance : loggedUser.getAllowances()) {
// Do many validations
if (pathsMatch(allowance, request)) {
return true;
}
}
return super.isAccessAllowed(request, response, mappedValue);
}
}
The isAccessAllowed() method is fired on every request, so I don't want to get the information from the database. Shiro builds many objects regarding the user, one of them is an AuthorizationInfo. I build a CustomAuthorizationInfo where the Permissions and Allowances list are inside... but how to retrieve those without re-accessing the database?
Is it possible to store/retrieve information from the autheticated user using shiro without accessing the database?
(PS.: methods like isPermitted does not solve the problem, because I need the permission itself to use the pathsMatch() method).
