Provide authorisation using apache shiro for Rest service method in java application

Question

in my simple web application, i have two web service method. one is storeName()and another one is viewAllNames() methods.

Admin role can be access to both methods. But user role should be access viewAllNames() method.

I am going to use Apache shiro, maven with web based project and rest service. Provide authorization only for those two methods.

My actual rest url is :

http://localhost:8080/SimpleRest/simpleservice/store/jackreobert  --> admin only
http://localhost:8080/SimpleRest/simpleservice/viewall/           --> user only

How to configure shiro.ini, web.xml and annotaion/xml.

For shiro approach, do i need pass any other information into web service url, how to achieve this.

SimpleService.java

package com.simple.rest;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.Produces;
import javax.ws.rs.core.Response;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.json.JSONException;

@Path("/simpleservice")
public class SimpleService {
   @Path("/store/{name}")
@GET
@Produces("application/json")
public Response storeName(@PathParam("name") String name) throws JSONException { 
/**
 * Here insert logic 
 */
String result = "Given name: " + name + " successfully stored";
return Respo}nse.status(200).entity(result).build();
}
@Path("/viewall")
@GET
@Produces("application/json")
public Response viewAllNames() throws JSONException { 
   /**
 * Here retrieve logic 
 */
String result = "All names are taken";
return Response.status(200).entity(result).build();
}}

Thanks for reading for my post. Help me, Thanks in advance.

Brian Demers Brian Demers · Accepted Answer · 2016-12-05T18:09:02

My suggestion is to use Permissions. Protect your application resources with permissions. Assign permissions to roles and assign Roles to Users.

As of Shiro 1.4.0-RC2 there is official JAX-RS support, take a look at the sample.

Provide authorisation using apache shiro for Rest service method in java application

1 Answers