How to find out it a URL is authorized?

[Lenny Primak <lp...@hope.nyc.ny.us>]

Hi guys,

I have a web page using Shiro, Tapestry and Tapestry-Security.
It works great.

I would like to do something like this, but can't find the info:

String page = "http://www.example.com/secured/page1";
if(isAuthorized(page)  // check against current Subject and current Shiro config
{
  println("This page is Authrized");
  redirect(page);
}

i.e.  I would like to check if a page is authorized or not, running via
Shiro's existing configuration just like it would when the page is accessed, but before its done so.
The URLs are actually relative though.

Thanks for all your help.

Re: How to find out it a URL is authorized?

[Lenny Primak <lp...@hope.nyc.ny.us>]

I guess I still wasn't clear...  My actual use case is complex so I will try to convey a new one.

- I have a list of pages: /mysite/a, /mysite/b, /mysite/c
- user lprimak only has access to /mysite/a

I want to have a web service, unauthenticated, for this example's sake,
that will return a list containing one item (/mysite/a)
when presented with a user lprimak and a list of pages stated above.

I am assuming that this has to traverse all the filters and isn't at all trivial,
hence why I am asking the question, or am I missing something?
BTW I don't use Spring, and the example below is foreign to me.
I use JEE Standard only + Shiro + Tapestry + Tapestry-Security

I want to run a URL through the filter chain, without actually having
an actual request from the user, and I want it to return whether it's authorized or not.

Thanks again.

On Jan 22, 2012, at 7:21 PM, jeffp wrote:

> The other way is to define it within the filterChainDefinitions.  You are
> still doing essentially the same thing, but you're being explicit about the
> URL or URL path.  Either way you'll need a map of User to URL through some
> mechanism.
> 
> 	 <bean id="shiroFilter"
> class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
> 	    <property name="securityManager" ref="securityManager"/>
> 	    <property name="loginUrl" value="/login.jsp"/>
> 		<property name="filterChainDefinitions">
> 		    <value>
>        		/login.jsp = authc
>        		/url/path/** = authc, perms[some-permission:view]
> 
> 
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-find-out-it-a-URL-is-authorized-tp7212711p7214512.html
> Sent from the Shiro User mailing list archive at Nabble.com.
> 

Re: How to find out it a URL is authorized?

[jeffp <je...@gmail.com>]

The other way is to define it within the filterChainDefinitions.  You are
still doing essentially the same thing, but you're being explicit about the
URL or URL path.  Either way you'll need a map of User to URL through some
mechanism.

	 <bean id="shiroFilter"
class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
	    <property name="securityManager" ref="securityManager"/>
	    <property name="loginUrl" value="/login.jsp"/>
		<property name="filterChainDefinitions">
		    <value>
        		/login.jsp = authc
        		/url/path/** = authc, perms[some-permission:view]


--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-find-out-it-a-URL-is-authorized-tp7212711p7214512.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: How to find out it a URL is authorized?

[Lenny Primak <lp...@hope.nyc.ny.us>]

Let me try to clear things up a bit.
I do have a completely working Shiro-based authentication / authorization system.
It works fantastic.  What I need is to check whether a particular URL is authorized, not 
whether a user is authorized within a role.
Thank you!

On Jan 22, 2012, at 4:45 PM, jeffp wrote:

> You probably want to implement a typical RBAC type model and map your Users
> to Roles and Roles to Permissions.
> 
> Then in your custom Realm implementation override
> doGetAuthorizationInfo(...), resolve the Roles/Permissions for the current
> user and return to Shiro.  
> 
> 		SimpleAuthorizationInfo authInfo = new
> SimpleAuthorizationInfo(acl.getRoles());
> 		authInfo.addStringPermissions(acl.getPermissions());
> 		return authInfo;
> 
> Check out the  http://shiro.apache.org/java-authorization-guide.html
> Authorization Guide  and read up on Permissions as there's where you'll gain
> the capability you want. Permissions can be fairly fine grain.
> 
> In your code you can then do something like this:
> if ( SecurityUtils.getSubject().isPermitted( permission ) ) {
>  // allow something
> }
> 
> The Shiro TagLibs also support the same permissions.
> 
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-find-out-it-a-URL-is-authorized-tp7212711p7214278.html
> Sent from the Shiro User mailing list archive at Nabble.com.
> 

Re: How to find out it a URL is authorized?

[jeffp <je...@gmail.com>]

You probably want to implement a typical RBAC type model and map your Users
to Roles and Roles to Permissions.

Then in your custom Realm implementation override
doGetAuthorizationInfo(...), resolve the Roles/Permissions for the current
user and return to Shiro.  

		SimpleAuthorizationInfo authInfo = new
SimpleAuthorizationInfo(acl.getRoles());
		authInfo.addStringPermissions(acl.getPermissions());
		return authInfo;

Check out the  http://shiro.apache.org/java-authorization-guide.html
Authorization Guide  and read up on Permissions as there's where you'll gain
the capability you want. Permissions can be fairly fine grain.

In your code you can then do something like this:
if ( SecurityUtils.getSubject().isPermitted( permission ) ) {
  // allow something
}

The Shiro TagLibs also support the same permissions.

--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-find-out-it-a-URL-is-authorized-tp7212711p7214278.html
Sent from the Shiro User mailing list archive at Nabble.com.