You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by Andreas Reichel <an...@manticore-projects.com> on 2024/09/07 09:04:11 UTC
Authorising against 120 roles fast
Greetings!
We have a need for authorising against 120 possible roles as fast a
possible. Those roles are managed in Active Directory and the OU
mapping is maintained in a shiro.ini file.
The roles are the product of: 2 applications for 20 legal entities and
5 application roles.
For the sake of maintenance of the shiro.ini file I am tempted to
define 1 realm for each application and entity, mapping those 5
application roles. (Alternatively I could create the Shiro
Configuration per Groovy Script dynamically, if that provided any
advantage.)
Would that have any negative side effects? Are realms processed in
parallel or in serial? What was best practice for my use case please?
Thank you big time in advance and warm regards
Andreas
Re: Authorising against 120 roles fast
Posted by Andreas Reichel <an...@manticore-projects.com>.
On Sat, 2024-09-07 at 14:33 -0500, lenny@flowlogix.com wrote:
> Just to make it clearer, there is no need to generate shiro.ini
> dynamically with a script,
> just generate permissions and/or roles dynamically in your custom
> realm,
> and use those either in your shiro.ini or in your code directly, as
> you see fit.
I would try both ways, because right now a dynamic configuration seems
to be easier and more flexible -- since I won't have control over the
120 AD OUs.
> Let us know how it goes
I would publish the example when its ready.
Maybe it can server as a template or case study for improvements.
Cheers!
Andreas
Re: Authorising against 120 roles fast
Posted by le...@flowlogix.com.
Just to make it clearer, there is no need to generate shiro.ini dynamically with a script,
just generate permissions and/or roles dynamically in your custom realm,
and use those either in your shiro.ini or in your code directly, as you see fit.
Let us know how it goes
> On Sep 7, 2024, at 1:46 PM, Andreas Reichel <an...@manticore-projects.com> wrote:
>
> On Sat, 2024-09-07 at 13:18 -0500, lenny@flowlogix.com wrote:
>> I think you would generate the permission based on your OU setting in AD dynamically in your custom realm.
>> You should start with a custom realm, and maybe roles are even good enough for you,
>> but you generate them dynamically in your realm, and not statically in your shiro.ini
>> It’s hard to determine what the exact path you need to take with the limited information provided :)
>>
>>> On Sep 7, 2024, at 1:14 PM, Andreas Reichel <andreas@manticore-projects.com <ma...@manticore-projects.com>> wrote:
>>>
>>>> i
>>
>
> Thank you Lenny, this part I do understand and I had something similar in mind when I wrote: generate the shiro configuration dynamically using a groovy script.
>
> Cheers!
Re: Authorising against 120 roles fast
Posted by Andreas Reichel <an...@manticore-projects.com>.
On Sat, 2024-09-07 at 13:18 -0500, lenny@flowlogix.com wrote:
> I think you would generate the permission based on your OU setting in
> AD dynamically in your custom realm.
> You should start with a custom realm, and maybe roles are even good
> enough for you,
> but you generate them dynamically in your realm, and not statically
> in your shiro.ini
> It’s hard to determine what the exact path you need to take with the
> limited information provided :)
>
> > On Sep 7, 2024, at 1:14 PM, Andreas Reichel
> > <an...@manticore-projects.com> wrote:
> >
> > > i
>
Thank you Lenny, this part I do understand and I had something similar
in mind when I wrote: generate the shiro configuration dynamically
using a groovy script.
Cheers!
Re: Authorising against 120 roles fast
Posted by le...@flowlogix.com.
I think you would generate the permission based on your OU setting in AD dynamically in your custom realm.
You should start with a custom realm, and maybe roles are even good enough for you,
but you generate them dynamically in your realm, and not statically in your shiro.ini
It’s hard to determine what the exact path you need to take with the limited information provided :)
> On Sep 7, 2024, at 1:14 PM, Andreas Reichel <an...@manticore-projects.com> wrote:
>
>> i
Re: Authorising against 120 roles fast
Posted by Andreas Reichel <an...@manticore-projects.com>.
On Sat, 2024-09-07 at 13:09 -0500, lenny@flowlogix.com wrote:
> No, that is not correct. You can override the “default” LDAP realm
> and create any permissions in that realm as you wish.
Ok, but how to express/configure this permission in AD then?
Would I not need to lookup Organisation Units and "memberOf" still?
Cheers
Andreas
Re: Authorising against 120 roles fast
Posted by le...@flowlogix.com.
You are most welcome! More comments below…
I think you need dynamic configuration with dynamic permissioning, and a custom realm.
See realm guide on how to do that.
> On Sep 7, 2024, at 12:54 PM, Andreas Reichel <an...@manticore-projects.com> wrote:
>
> Thank you again Lenny,
>
> I am actually familar with that documentation however I seem not have understood it in full:
>
> - since I use AD I don't think I can use permission based authorisation, is that correct?
No, that is not correct. You can override the “default” LDAP realm and create any permissions in that realm as you wish.
> - in the result I am stuck with role based authorisation, right?
Also not correct.
>
> This lead me to my assumption that I would need 120 organisation units in AD to express 2 x 5 x 20 application roles.
> Hence my pursuit how to configure this mapping efficiently inside the shiro.ini
>
> What am I missing please?
>
> Warm regards
> Andreas
Re: Authorising against 120 roles fast
Posted by Andreas Reichel <an...@manticore-projects.com>.
Thank you again Lenny,
I am actually familar with that documentation however I seem not have
understood it in full:
- since I use AD I don't think I can use permission based
authorisation, is that correct?
- in the result I am stuck with role based authorisation, right?
This lead me to my assumption that I would need 120 organisation units
in AD to express 2 x 5 x 20 application roles.
Hence my pursuit how to configure this mapping efficiently inside the
shiro.ini
What am I missing please?
Warm regards
Andreas
Re: Authorising against 120 roles fast
Posted by le...@flowlogix.com.
You are very welcome!
See This for an overview of authorization in general: https://shiro.apache.org/java-authorization-guide.html <https://shiro.apache.org/java-authorization-guide.html>
This for realms: https://shiro.apache.org/realm.html <https://shiro.apache.org/realm.html>
This specifically for permissions: https://shiro.apache.org/permissions.html <https://shiro.apache.org/permissions.html>
> On Sep 7, 2024, at 12:41 PM, Andreas Reichel <an...@manticore-projects.com> wrote:
>
> Hi Lenny, thank you for respondig.
>
> On Sat, 2024-09-07 at 12:33 -0500, lenny@flowlogix.com <ma...@flowlogix.com> wrote:
>> Just throwing something out there, would wildcard permissions work better than the role mapping strategy you have there?
>
> Can you please elaborate or point me on a ling for reading up?
> So far I only understand realms and AD organisation units.
>
>> Also, do you ned multiple realms?
>
> I don't know for sure, although its the concept I understand best.
>
>> What you are describing is highly unusual.
>
> I hear this quite often, it must be my fortune.
>
>>
>> In any case, realms are resolved serially.
>
> Ok, thanks for this clarification!
>
> Cheers
> Andreas
Re: Authorising against 120 roles fast
Posted by Andreas Reichel <an...@manticore-projects.com>.
Hi Lenny, thank you for respondig.
On Sat, 2024-09-07 at 12:33 -0500, lenny@flowlogix.com wrote:
> Just throwing something out there, would wildcard permissions work
> better than the role mapping strategy you have there?
Can you please elaborate or point me on a ling for reading up?
So far I only understand realms and AD organisation units.
> Also, do you ned multiple realms?
I don't know for sure, although its the concept I understand best.
> What you are describing is highly unusual.
I hear this quite often, it must be my fortune.
>
> In any case, realms are resolved serially.
Ok, thanks for this clarification!
Cheers
Andreas
Re: Authorising against 120 roles fast
Posted by le...@flowlogix.com.
Just throwing something out there, would wildcard permissions work better than the role mapping strategy you have there?
Also, do you ned multiple realms? What you are describing is highly unusual.
In any case, realms are resolved serially. Usually scalability is achieved via multiple threads (thread-per-user)
and if your individual user takes too long to log in, it is indicative of a design issue somewhere in the system.
> On Sep 7, 2024, at 4:04 AM, Andreas Reichel <an...@manticore-projects.com> wrote:
>
> Greetings!
>
> We have a need for authorising against 120 possible roles as fast a possible. Those roles are managed in Active Directory and the OU mapping is maintained in a shiro.ini file.
>
> The roles are the product of: 2 applications for 20 legal entities and 5 application roles.
>
> For the sake of maintenance of the shiro.ini file I am tempted to define 1 realm for each application and entity, mapping those 5 application roles. (Alternatively I could create the Shiro Configuration per Groovy Script dynamically, if that provided any advantage.)
>
> Would that have any negative side effects? Are realms processed in parallel or in serial? What was best practice for my use case please?
>
> Thank you big time in advance and warm regards
> Andreas