You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@shiro.apache.org by bd...@apache.org on 2017/06/22 20:11:13 UTC
[01/12] shiro-site git commit: Update authorization.md.vtl
Repository: shiro-site
Updated Branches:
refs/heads/master b80842a0a -> 5a9931e92
Update authorization.md.vtl
correct a typo
Fixes: #13
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/54d249c1
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/54d249c1
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/54d249c1
Branch: refs/heads/master
Commit: 54d249c1941940d0e2b1e7c6d5529478fa23d38f
Parents: b80842a
Author: kingviker <ki...@gmail.com>
Authored: Thu Mar 2 14:57:00 2017 +0800
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 15:44:05 2017 -0400
----------------------------------------------------------------------
authorization.md.vtl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/54d249c1/authorization.md.vtl
----------------------------------------------------------------------
diff --git a/authorization.md.vtl b/authorization.md.vtl
index 59aeaf1..a0fb898 100644
--- a/authorization.md.vtl
+++ b/authorization.md.vtl
@@ -112,7 +112,7 @@ There are effectively two types of Roles, and Shiro supports both concepts:
<p>For example, what if you just want to add or remove a role, or redefine a role''s behavior later? You''ll have to go back into your source code and change all your role checks to reflect the change in your security model, every time such a change is required! Not to mention the operational costs this would incur (re-test, go through QA, shut down the app, upgrade the software with the new role checks, restart the app, etc).</p>
<p>This is probably ok for very simple applications (e.g. maybe there is an ''admin'' role and ''everyone else''). But for more complicated or configurable applications, this can be a major major problem throughout the life of your application and drive a large maintenance cost for your software.</p>')
-* **Excplict Roles**: An explicit role however is essentially a named collection of actual permission statements. In this form, the application (and Shiro) knows _exactly_ what it means to have a particular role or not. Because it is known the _exact_ behavior that can be performed or not, there is no guessing or implying what a particular role can or can not do.
+* **Explicit Roles**: An explicit role however is essentially a named collection of actual permission statements. In this form, the application (and Shiro) knows _exactly_ what it means to have a particular role or not. Because it is known the _exact_ behavior that can be performed or not, there is no guessing or implying what a particular role can or can not do.
The Shiro team advocates using permissions and explicit roles instead of the older implicit approach. You will have much greater control over your application's security experience.
[07/12] shiro-site git commit: small typos
Posted by bd...@apache.org.
small typos
Fixes: #18
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/38619b0a
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/38619b0a
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/38619b0a
Branch: refs/heads/master
Commit: 38619b0a498ae348c572bdc85fcedf323ab7632b
Parents: bd3ab51
Author: Jens Piegsa <pi...@gmail.com>
Authored: Wed May 10 11:30:39 2017 +0200
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:44 2017 -0400
----------------------------------------------------------------------
authorization-features.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/38619b0a/authorization-features.md
----------------------------------------------------------------------
diff --git a/authorization-features.md b/authorization-features.md
index cf0eb88..99eac94 100644
--- a/authorization-features.md
+++ b/authorization-features.md
@@ -14,11 +14,11 @@ Authorization is a critical element of any application but it can quickly become
* **Powerful and intuitive permission syntax** - As an option, Shiro provides an out-of-the-box permission syntax, called Wildcard Permissions, that help you model the fine grained access policies your application may have. By using Shiro's Wildcard Permissions you get an easy-to-process and human readable syntax. Moreoever, you don't have to go through the time-consuming effort and complexity of creating your own method for representing your access policies.
-* **Multiple enforcement options** – Authorization checks in Shiro can be done through in-code checks, JDK 1.5 annotations, AOP, and JSP/GSP Taglibs. Shiro's goal is to give you the choice to use the option you think are best based on your preferences and project needs.
+* **Multiple enforcement options** - Authorization checks in Shiro can be done through in-code checks, JDK 1.5 annotations, AOP, and JSP/GSP Taglibs. Shiro's goal is to give you the choice to use the option you think are best based on your preferences and project needs.
* **Strong caching support** - Any of the modern open-source and/or enterprise caching products can be plugged in to Shiro to provide a fast and efficient user-experience. For authorization, caching is crucial for performance in larger environments or with more complex policies using back-end security data sources.
-* **Pluggable data sources** - Shiro uses pluggable data access objects, referred to as Realms, to connect to security data sources where you keep your access control information, like a LDAP or a relational database. To help you avoid building and maintaining integrations yourself, Shiro provides out-of-the-box realms for popular data sources like LDAP, Active Directory, and JDBC. If needed, you can also create your own realms to support specific functionality not included in the basic realms.
+* **Pluggable data sources** - Shiro uses pluggable data access objects, referred to as Realms, to connect to security data sources where you keep your access control information, like an LDAP server or a relational database. To help you avoid building and maintaining integrations yourself, Shiro provides out-of-the-box realms for popular data sources like LDAP, Active Directory, and JDBC. If needed, you can also create your own realms to support specific functionality not included in the basic realms.
-* **Supports any data model** - Shiro can support any data model for access control-- it doesn't force a model on you. Your realm implementation ultimately decides how your permissions and roles are grouped together and whether to return a "yes" or a "no" answer to Shiro. This feature allows you to architect your application in the manner you chose and Shiro will bend to support you.
+* **Supports any data model** - Shiro can support any data model for access control—it doesn't force a model on you. Your realm implementation ultimately decides how your permissions and roles are grouped together and whether to return a "yes" or a "no" answer to Shiro. This feature allows you to architect your application in the manner you chose and Shiro will bend to support you.
<input type="hidden" id="ghEditPage" value="authorization-features.md"></input>
[05/12] shiro-site git commit: Update web.md.vtl
Posted by bd...@apache.org.
Update web.md.vtl
fix jsp tag error for hasAnyRoles and lacksPermission
Fixes: #20
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/45947e1f
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/45947e1f
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/45947e1f
Branch: refs/heads/master
Commit: 45947e1f052023c48618b41db605e7ea72e79213
Parents: 92df920
Author: nuccch <nu...@163.com>
Authored: Mon May 22 15:26:51 2017 +0800
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:44 2017 -0400
----------------------------------------------------------------------
web.md.vtl | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/45947e1f/web.md.vtl
----------------------------------------------------------------------
diff --git a/web.md.vtl b/web.md.vtl
index db56c64..d9f5f6b 100644
--- a/web.md.vtl
+++ b/web.md.vtl
@@ -840,7 +840,7 @@ For example:
``` html
<shiro:hasAnyRoles name="developer, project manager, administrator">
You are either a developer, project manager, or administrator.
-</shiro:lacksRole>
+</shiro:hasAnyRoles>
```
The `hasAnyRole` tag does not currently have a logically opposite tag.
@@ -872,7 +872,7 @@ For example:
``` html
<shiro:lacksPermission name="user:delete">
Sorry, you are not allowed to delete user accounts.
-</shiro:hasPermission>
+</shiro:lacksPermission>
```
The `lacksPermission` tag is the logical opposite of the [hasPermission](#Web-haspermissiontag) tag.
[10/12] shiro-site git commit: Add Realm Authorization section
Posted by bd...@apache.org.
Add Realm Authorization section
Fixes: #21
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/e89c14bd
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/e89c14bd
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/e89c14bd
Branch: refs/heads/master
Commit: e89c14bda2610af98c5ca0805cb5bf64e37fc9fc
Parents: 45947e1
Author: Gautam Singh <gk...@hotmail.com>
Authored: Fri May 26 11:17:48 2017 -0500
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:45 2017 -0400
----------------------------------------------------------------------
realm.md.vtl | 30 ++++++++++++++++++++++++++++--
1 file changed, 28 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/e89c14bd/realm.md.vtl
----------------------------------------------------------------------
diff --git a/realm.md.vtl b/realm.md.vtl
index 9ed93d0..32f538f 100644
--- a/realm.md.vtl
+++ b/realm.md.vtl
@@ -21,7 +21,8 @@
* [Disabling Authentication](#Realm-DisablingAuthentication)
* [Realm Authorization](#Realm-RealmAuthorization)
-
+ * [Role based Authorization](#Realm-RoleBasedAuthorization)
+ * [Permission based Authorization](#Realm-PermissionBasedAuthorization)
A `Realm` is a component that can access application-specific security data such as users, roles, and permissions. The `Realm` translates this application-specific data into a format that Shiro understands so Shiro can in turn provide a single easy-to-understand [Subject](subject.html "Subject") programming API no matter how many data sources exist or how application-specific your data might be.
Realms usually have a 1-to-1 correlation with a data source such as a relational database, LDAP directory, file system, or other similar resource. As such, implementations of the `Realm` interface use data source-specific APIs to discover authorization data (roles, permissions, etc), such as JDBC, File IO, Hibernate or JPA, or any other Data Access API.
@@ -234,7 +235,32 @@ Of course at least one configured `Realm` needs to be able to support Authentica
Realm Authorization
-------------------
-TBD
+`SecurityManager` delegates the task of `Permission` or `Role` checking to [Authorizer](static/current/apidocs/org/apache/shiro/authz/Authorizer.html), defaulted to [ModularRealmAuthorizer](static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html).
+
+<a name="Realm-RoleBasedAuthorization"></a>
+#[[#####Role based Authorization]]#
+
+When one of the overloaded method hasRoles or checkRoles method is called on Subject
+
+1. `Subject` delegates to `SecurityManger` for identifying if the given Role is assigned
+2. `SecurityManger` then delegates to `Authorizer`
+3. [Authorizer](static/current/apidocs/org/apache/shiro/authz/Authorizer.html) then referrers to all the Authorizing Realms one by one until it found given role assigned to the subject. Deny access by returning false if no none of the Realm grants Subject given Role
+4. Authorizing Realm [AuthorizationInfo](static/current/apidocs/org/apache/shiro/authz/AuthorizationInfo.html) getRoles() method to get all Roles assigned to Subject
+5. Grant access if it found the given Role in list of roles returned from AuthorizationInfo.getRoles call.
+
+Permission based Authorization
+
+When one of the overloaded method isPermitted or checkPermission method is called on Subject
+
+1. `Subject` delegates the task to grant or deny Permission to SecurityManger
+2. `SecurityManger` then delegates to Authorizer
+3. Authorizer then referrers to all the Authorizer Realms one by one until it Permission is granted.
+If Permission is not granted by any of the Authorizing Realm, Subject is denied Permission
+4. Authorizing Realm does following to identify if Subject is allowed to perform an action or access a resource based on given Permission
+a. First it gets identify all Permissions assigned to Subject directly by calling getObjectPermissions() and getStringPermissions methods on [AuthorizationInfo](static/current/apidocs/org/apache/shiro/authz/AuthorizationInfo.html) and aggregating the results.
+b. If a [RolePermissionResolver](static/current/apidocs/org/apache/shiro/authz/permission/RolePermissionResolver.html) is registered (explicit role), then to get the aggregated Permission based on all roles assigned to Subject RolePermissionResolver resolvePermissionsInRole() method is called for all Subject’s roles.
+c. For aggregated Permissions from a. and b. implies() method is called to checks if anyone of these permission implied the given permission. The Permission is granted based on WildcardPermission rules
+
#lendAHandDoc()
[04/12] shiro-site git commit: duplicate word removed
Posted by bd...@apache.org.
duplicate word removed
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/92df9204
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/92df9204
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/92df9204
Branch: refs/heads/master
Commit: 92df9204234863438090c05f5671d4de33c15e27
Parents: adc5f31
Author: Jens Piegsa <pi...@gmail.com>
Authored: Wed May 31 17:04:22 2017 +0200
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:44 2017 -0400
----------------------------------------------------------------------
architecture.md.vtl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/92df9204/architecture.md.vtl
----------------------------------------------------------------------
diff --git a/architecture.md.vtl b/architecture.md.vtl
index 59b7b89..44c3819 100644
--- a/architecture.md.vtl
+++ b/architecture.md.vtl
@@ -96,7 +96,7 @@ To simplify configuration and enable flexible configuration/pluggability, Shiro'
While the components actually execute the logic, the `SecurityManager` implementation knows how and when to coordinate the components for the correct behavior.
-The `SecurityManager` implementations and and the components are also JavaBeans compatible, which allows you (or a configuration mechanism) to easily customize the pluggable components via standard JavaBeans accessor/mutator methods (get*/set*). This means the Shiro's architectural modularity can translate into very easy configuration for custom behavior.
+The `SecurityManager` implementations and the components are also JavaBeans compatible, which allows you (or a configuration mechanism) to easily customize the pluggable components via standard JavaBeans accessor/mutator methods (get*/set*). This means the Shiro's architectural modularity can translate into very easy configuration for custom behavior.
#tip('Easy Configuration', 'Because of JavaBeans compatibility, it is very easy to configure the `SecurityManager` with custom components via any mechanism that supports JavaBeans-style configuration, such as <a href="spring.html" title="Spring">Spring</a>, Guice, JBoss, etc.')
[12/12] shiro-site git commit: added Flow Logix library
Posted by bd...@apache.org.
added Flow Logix library
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/e2688b47
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/e2688b47
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/e2688b47
Branch: refs/heads/master
Commit: e2688b4706d639e2f201be22dd9b84a651ffc89c
Parents: e89c14b
Author: lprimak <le...@flowlogix.com>
Authored: Wed Jun 7 18:43:57 2017 -0500
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:45 2017 -0400
----------------------------------------------------------------------
integration.md | 3 +++
1 file changed, 3 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/e2688b47/integration.md
----------------------------------------------------------------------
diff --git a/integration.md b/integration.md
index fb5ec3b..e93019c 100644
--- a/integration.md
+++ b/integration.md
@@ -68,6 +68,9 @@ A highly configurable URL-rewriting tool for Java EE 6+ and Servlet 2.5+ applica
* **[Freedomotic](http://freedomotic-developer-manual.readthedocs.io/en/latest/plugins/security.html)** from [freedomotic](http://www.freedomotic.com)
An open source, flexible, secure Internet of Things (IoT) development framework in Java, useful to build and manage modern smart spaces.
+* **[FlowLogix Java EE Library](https://github.com/flowlogix/flowlogix/tree/master/flowlogix-jee)** from [Lenny Primak](https://twitter.com/lprimak)
+Integrates Java EE applications with Shiro Security, specifically makes Shiro Annotations work with Java EE
+
## Ports
* **[Turnstile](https://github.com/stormpath/Turnstile)** - Swift
[06/12] shiro-site git commit: missing word added
Posted by bd...@apache.org.
missing word added
Fixes: #19
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/adc5f311
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/adc5f311
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/adc5f311
Branch: refs/heads/master
Commit: adc5f311128accefe322ecac144d7f708df77588
Parents: 38619b0
Author: Jens Piegsa <pi...@gmail.com>
Authored: Wed May 10 19:46:02 2017 +0200
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:44 2017 -0400
----------------------------------------------------------------------
architecture.md.vtl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/adc5f311/architecture.md.vtl
----------------------------------------------------------------------
diff --git a/architecture.md.vtl b/architecture.md.vtl
index d5c309b..59b7b89 100644
--- a/architecture.md.vtl
+++ b/architecture.md.vtl
@@ -96,7 +96,7 @@ To simplify configuration and enable flexible configuration/pluggability, Shiro'
While the components actually execute the logic, the `SecurityManager` implementation knows how and when to coordinate the components for the correct behavior.
-The `SecurityManager` implementations and are also JavaBeans compatible, which allows you (or a configuration mechanism) to easily customize the pluggable components via standard JavaBeans accessor/mutator methods (get*/set*). This means the Shiro's architectural modularity can translate into very easy configuration for custom behavior.
+The `SecurityManager` implementations and and the components are also JavaBeans compatible, which allows you (or a configuration mechanism) to easily customize the pluggable components via standard JavaBeans accessor/mutator methods (get*/set*). This means the Shiro's architectural modularity can translate into very easy configuration for custom behavior.
#tip('Easy Configuration', 'Because of JavaBeans compatibility, it is very easy to configure the `SecurityManager` with custom components via any mechanism that supports JavaBeans-style configuration, such as <a href="spring.html" title="Spring">Spring</a>, Guice, JBoss, etc.')
[03/12] shiro-site git commit: Fixed a typo
Posted by bd...@apache.org.
Fixed a typo
Changed the typo. Search for text: component that talks to. Changed talkts to talks.
Fixes: #15
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/bd3ab51f
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/bd3ab51f
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/bd3ab51f
Branch: refs/heads/master
Commit: bd3ab51f8523fb676da079b0becf5be6213da267
Parents: 2ec6c29
Author: Vishal Srivastava <vi...@yahoo.co.in>
Authored: Wed Mar 22 13:29:41 2017 +0530
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:18 2017 -0400
----------------------------------------------------------------------
java-authentication-guide.md.vtl | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/bd3ab51f/java-authentication-guide.md.vtl
----------------------------------------------------------------------
diff --git a/java-authentication-guide.md.vtl b/java-authentication-guide.md.vtl
index 878b187..8dabaa2 100644
--- a/java-authentication-guide.md.vtl
+++ b/java-authentication-guide.md.vtl
@@ -16,7 +16,7 @@ Terminology you'll need
* **Credentials** - secret data that are used to verify identities. Passwords, Biometric data, x509 certificates,
-* **Realms** - Security specific DAO, data access object, software component that talkts to a backend data source. If you have usernames and password in LDAP, then you would have an LDAP Realm that would communicate with LDAP. The idea is that you would use a realm per back-end data source and Shiro would know how to coordinate with these realms together to do what you have to do.
+* **Realms** - Security specific DAO, data access object, software component that talks to a backend data source. If you have usernames and password in LDAP, then you would have an LDAP Realm that would communicate with LDAP. The idea is that you would use a realm per back-end data source and Shiro would know how to coordinate with these realms together to do what you have to do.
<a name="JavaAuthenticationGuide-HowtoAuthenticateinJavawithShiro"></a>
#[[##How to Authenticate in Java with Shiro]]#
[11/12] shiro-site git commit: Quick formatting fix for Flowlogic
integration
Posted by bd...@apache.org.
Quick formatting fix for Flowlogic integration
Fixes: #22
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/05ac7740
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/05ac7740
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/05ac7740
Branch: refs/heads/master
Commit: 05ac77404aee7808d759efa926c16d0b09d6aaa0
Parents: 78e80b5
Author: Brian Demers <bd...@apache.org>
Authored: Thu Jun 22 15:42:44 2017 -0400
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:45 2017 -0400
----------------------------------------------------------------------
integration.md | 3 +++
1 file changed, 3 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/05ac7740/integration.md
----------------------------------------------------------------------
diff --git a/integration.md b/integration.md
index b2e9459..fa69b77 100644
--- a/integration.md
+++ b/integration.md
@@ -68,6 +68,9 @@ A highly configurable URL-rewriting tool for Java EE 6+ and Servlet 2.5+ applica
* **[Freedomotic](http://freedomotic-developer-manual.readthedocs.io/en/latest/plugins/security.html)** from [freedomotic](http://www.freedomotic.com)
An open source, flexible, secure Internet of Things (IoT) development framework in Java, useful to build and manage modern smart spaces.
+* **[FlowLogix Java EE Library](https://github.com/flowlogix/flowlogix/tree/master/flowlogix-jee)** from [Lenny Primak](https://twitter.com/lprimak)
+Integrates Java EE applications with Shiro Security, specifically makes Shiro Annotations work with Java EE.
+
* **[Bootique Shiro](https://github.com/bootique/bootique-shiro)** from [Bootique](https://github.com/bootique/bootique)
Bootique is a minimally opinionated platform for modern runnable Java apps.
[09/12] shiro-site git commit: Add Bootique Shiro to Shiro
Integrations.
Posted by bd...@apache.org.
Add Bootique Shiro to Shiro Integrations.
Fixes: #23
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/78e80b55
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/78e80b55
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/78e80b55
Branch: refs/heads/master
Commit: 78e80b55885b0878f809f944c9a1f216c4fb334d
Parents: e2688b4
Author: Ruslan Ibragimov <ru...@ibragimov.by>
Authored: Mon Jun 19 12:07:13 2017 +0300
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:45 2017 -0400
----------------------------------------------------------------------
integration.md | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/78e80b55/integration.md
----------------------------------------------------------------------
diff --git a/integration.md b/integration.md
index e93019c..b2e9459 100644
--- a/integration.md
+++ b/integration.md
@@ -68,8 +68,9 @@ A highly configurable URL-rewriting tool for Java EE 6+ and Servlet 2.5+ applica
* **[Freedomotic](http://freedomotic-developer-manual.readthedocs.io/en/latest/plugins/security.html)** from [freedomotic](http://www.freedomotic.com)
An open source, flexible, secure Internet of Things (IoT) development framework in Java, useful to build and manage modern smart spaces.
-* **[FlowLogix Java EE Library](https://github.com/flowlogix/flowlogix/tree/master/flowlogix-jee)** from [Lenny Primak](https://twitter.com/lprimak)
-Integrates Java EE applications with Shiro Security, specifically makes Shiro Annotations work with Java EE
+* **[Bootique Shiro](https://github.com/bootique/bootique-shiro)** from [Bootique](https://github.com/bootique/bootique)
+Bootique is a minimally opinionated platform for modern runnable Java apps.
+
## Ports
[02/12] shiro-site git commit: Couple of typos in permissions.md
Posted by bd...@apache.org.
Couple of typos in permissions.md
Fixes: #14
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/2ec6c29f
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/2ec6c29f
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/2ec6c29f
Branch: refs/heads/master
Commit: 2ec6c29fffb0e60a6cc164f4b9caed67c87c368f
Parents: 54d249c
Author: Anton von Borries <an...@live.de>
Authored: Thu Mar 2 10:58:50 2017 +0000
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 15:44:36 2017 -0400
----------------------------------------------------------------------
permissions.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/2ec6c29f/permissions.md
----------------------------------------------------------------------
diff --git a/permissions.md b/permissions.md
index cb8fe98..ed8071c 100644
--- a/permissions.md
+++ b/permissions.md
@@ -27,9 +27,9 @@ So to enable easy-to-process yet still readable permission statements, Shiro pro
<a name="Permissions-SimpleUsage"></a>
###Simple Usage
-Let's you want to protect access to your company's printers such that some people can print to particular printers, while others can query what jobs are currently in the queue.
+Let's say you want to protect access to your company's printers such that some people can print to particular printers, while others can query what jobs are currently in the queue.
-An extremely simple approach would be to use grant the user a "queryPrinter" permission. Then you could check to see if the user has the queryPrinter permission by calling:
+An extremely simple approach would be to grant the user a "queryPrinter" permission. Then you could check to see if the user has the queryPrinter permission by calling:
``` java
subject.isPermitted("queryPrinter")
[08/12] shiro-site git commit: Minor formatting changes for #21
Posted by bd...@apache.org.
Minor formatting changes for #21
Fixes: #21
Project: http://git-wip-us.apache.org/repos/asf/shiro-site/repo
Commit: http://git-wip-us.apache.org/repos/asf/shiro-site/commit/5a9931e9
Tree: http://git-wip-us.apache.org/repos/asf/shiro-site/tree/5a9931e9
Diff: http://git-wip-us.apache.org/repos/asf/shiro-site/diff/5a9931e9
Branch: refs/heads/master
Commit: 5a9931e92e6eca91da2e4b86c2970bf1cf1aaec5
Parents: 05ac774
Author: Brian Demers <bd...@apache.org>
Authored: Thu Jun 22 16:09:25 2017 -0400
Committer: Brian Demers <bd...@apache.org>
Committed: Thu Jun 22 16:10:45 2017 -0400
----------------------------------------------------------------------
realm.md.vtl | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/shiro-site/blob/5a9931e9/realm.md.vtl
----------------------------------------------------------------------
diff --git a/realm.md.vtl b/realm.md.vtl
index 32f538f..5a5db97 100644
--- a/realm.md.vtl
+++ b/realm.md.vtl
@@ -23,6 +23,7 @@
* [Realm Authorization](#Realm-RealmAuthorization)
* [Role based Authorization](#Realm-RoleBasedAuthorization)
* [Permission based Authorization](#Realm-PermissionBasedAuthorization)
+
A `Realm` is a component that can access application-specific security data such as users, roles, and permissions. The `Realm` translates this application-specific data into a format that Shiro understands so Shiro can in turn provide a single easy-to-understand [Subject](subject.html "Subject") programming API no matter how many data sources exist or how application-specific your data might be.
Realms usually have a 1-to-1 correlation with a data source such as a relational database, LDAP directory, file system, or other similar resource. As such, implementations of the `Realm` interface use data source-specific APIs to discover authorization data (roles, permissions, etc), such as JDBC, File IO, Hibernate or JPA, or any other Data Access API.
@@ -248,18 +249,22 @@ When one of the overloaded method hasRoles or checkRoles method is called on Sub
4. Authorizing Realm [AuthorizationInfo](static/current/apidocs/org/apache/shiro/authz/AuthorizationInfo.html) getRoles() method to get all Roles assigned to Subject
5. Grant access if it found the given Role in list of roles returned from AuthorizationInfo.getRoles call.
-Permission based Authorization
+<a name="Realm-PermissionBasedAuthorization"></a>
+#[[#####Permission based Authorization]]#
+
+When one of the overloaded method `isPermitted()` or `checkPermission()` method are called on Subject:
+
+1. `Subject` delegates the task to grant or deny Permission to SecurityManger
+2. `SecurityManger` then delegates to Authorizer
+3. Authorizer then referrers to all of the Authorizer Realms one by one until it Permission is granted
+ If Permission is not granted by any of the Authorizing Realm, Subject is denied Permission
+4. Authorizing Realm does the following in order to check if a Subject is permitted:
+
+ a. First it gets identify all Permissions assigned to Subject directly by calling getObjectPermissions() and getStringPermissions methods on [AuthorizationInfo](static/current/apidocs/org/apache/shiro/authz/AuthorizationInfo.html) and aggregating the results.
-When one of the overloaded method isPermitted or checkPermission method is called on Subject
+ b. If a [RolePermissionResolver](static/current/apidocs/org/apache/shiro/authz/permission/RolePermissionResolver.html) is registered, it is used to retrieve Permissions based on all of the roles assigned to Subject by calling the `RolePermissionResolver.resolvePermissionsInRole()`
-1. `Subject` delegates the task to grant or deny Permission to SecurityManger
-2. `SecurityManger` then delegates to Authorizer
-3. Authorizer then referrers to all the Authorizer Realms one by one until it Permission is granted.
-If Permission is not granted by any of the Authorizing Realm, Subject is denied Permission
-4. Authorizing Realm does following to identify if Subject is allowed to perform an action or access a resource based on given Permission
-a. First it gets identify all Permissions assigned to Subject directly by calling getObjectPermissions() and getStringPermissions methods on [AuthorizationInfo](static/current/apidocs/org/apache/shiro/authz/AuthorizationInfo.html) and aggregating the results.
-b. If a [RolePermissionResolver](static/current/apidocs/org/apache/shiro/authz/permission/RolePermissionResolver.html) is registered (explicit role), then to get the aggregated Permission based on all roles assigned to Subject RolePermissionResolver resolvePermissionsInRole() method is called for all Subject’s roles.
-c. For aggregated Permissions from a. and b. implies() method is called to checks if anyone of these permission implied the given permission. The Permission is granted based on WildcardPermission rules
+ c. For aggregated Permissions from a. and b. the implies() method is called to check if any of these permission are implied the checked permission. See [WildcardPermission](permissions.html#Permissions-WildcardPermissions)
#lendAHandDoc()