Is there any problems if I want to create many DefaultSecurityManager instance in one JVM?

[chi qiu <qc...@gmail.com>]

Hi,

In my standalone application, I have a problem that I want to create
AuthenticationRealms dynamically according to incoming subjects. So I plan
to create securityManagers instances dynamically and add the realms I
created into a new  SecurityManager instance.

My logic is like this:

one incoming request->Create realms-> new SecurityManger and set realms->
new Shiro delegate Subject which delegates the SecurityManger ->
subject.login()

I have disabled shiro internal session ,RememberMeManager and
SessionManager. And I am not using threadlocal in shiro.

On the shiro official documents, I saw it is recommended to use
SecurityManger as a singleton. Is there any problems I may have if I create
SecurityManagers in this way?

Thanks!

Chi

Re: Is there any problems if I want to create many DefaultSecurityManager instance in one JVM?

[charlieqiu <qc...@gmail.com>]

Les,
Thank you for your confirm!
Charlie



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Is-there-any-problems-if-I-want-to-create-many-DefaultSecurityManager-instance-in-one-JVM-tp7577924p7577943.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Is there any problems if I want to create many DefaultSecurityManager instance in one JVM?

[Les Hazlewood <lh...@apache.org>]

Hi Charlie,

I don't see a problem with this approach - the SecurityManager object graph
is extremely lightweight (maybe 5 or 10 object instances without remember
me or session management) so it could be instantiated as necessary without
impact.

Another approach is to keep a SecurityManager singleton for your entire
application and configure a custom Authenticator instance that dynamically
creates things as necessary based on the submitted AuthenticationToken.
 Not sure if that works for you, but it might be helpful.

HTH,

--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
Stormpath wins GigaOM Structure Launchpad Award! http://bit.ly/MvZkMk

On Mon, Nov 12, 2012 at 8:04 PM, charlieqiu <qc...@gmail.com> wrote:

> Hi,
> My case is that I only need the plug-able realm design(which I do love so
> much) and I don't need session session manager and cache manager(I cache
> the
> results in another layer). I just ran a few tests and it seems everything
> goes well. But I still want to make sure is there any problem that may
> happen if I create a new DefaultSecurityManager(with subjectDao , cache,
> SessionManager turned off) instance for every Subject.login()?
>
> Thanks!
> Charlie
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Is-there-any-problems-if-I-want-to-create-many-DefaultSecurityManager-instance-in-one-JVM-tp7577924p7577926.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: Is there any problems if I want to create many DefaultSecurityManager instance in one JVM?

[charlieqiu <qc...@gmail.com>]

Hi,
My case is that I only need the plug-able realm design(which I do love so
much) and I don't need session session manager and cache manager(I cache the
results in another layer). I just ran a few tests and it seems everything
goes well. But I still want to make sure is there any problem that may
happen if I create a new DefaultSecurityManager(with subjectDao , cache,
SessionManager turned off) instance for every Subject.login()?

Thanks!
Charlie



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Is-there-any-problems-if-I-want-to-create-many-DefaultSecurityManager-instance-in-one-JVM-tp7577924p7577926.html
Sent from the Shiro User mailing list archive at Nabble.com.