You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@shiro.apache.org by lp...@apache.org on 2026/10/11 06:07:18 UTC
(shiro-site) branch asf-site updated: Oct 11, 2026 update
This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new faec2b76f Oct 11, 2026 update
faec2b76f is described below
commit faec2b76f5528270f351a20c272d5a47e9d836b0
Author: lprimak <le...@flowlogix.com>
AuthorDate: Sun Oct 11 01:07:05 2026 -0500
Oct 11, 2026 update
---
.gitignore | 9 ++
.well-known/security.txt | 2 +-
architecture.html | 4 +-
authentication.html | 3 +
authenticator.html | 263 ++++++++++++++++++++++++++++++++----
authorization.html | 3 +
authorizer.html | 296 ++++++++++++++++++++++++++++++++++++++---
documentation.html | 23 +++-
feed.xml | 2 +-
get-started.html | 39 ++++++
guides.html | 88 +++++++++++-
issues.html | 7 +-
java-authentication-guide.html | 28 ++++
java-authorization-guide.html | 29 +++-
reference.html | 39 ++++++
sitemap.xml | 16 +--
16 files changed, 781 insertions(+), 70 deletions(-)
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..e9daf1963
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+*.iml
+.idea/
+/output
+/target/
+/.project
+/.settings
+/cache
+.sdkmanrc
+.DS_Store
diff --git a/.well-known/security.txt b/.well-known/security.txt
index fc359b2fe..405a4c9cb 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:security@shiro.apache.org
-Expires: 2027-09-26T17:08:16Z
+Expires: 2027-10-11T06:06:47Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/architecture.html b/architecture.html
index 7d1076730..5efb72e7e 100644
--- a/architecture.html
+++ b/architecture.html
@@ -301,7 +301,7 @@ As mentioned above, the <code>SecurityManager</code> is the heart of Shiro’
</li>
<li>
<p><strong>Authenticator</strong> (<a href="static/current/apidocs/org/apache/shiro/authc/Authenticator.html">org.apache.shiro.authc.Authenticator</a>)
-The <code>Authenticator</code> is the component that is responsible for executing and reacting to authentication (log-in) attempts by users. When a user tries to log-in, that logic is executed by the <code>Authenticator</code>. The <code>Authenticator</code> knows how to coordinate with one or more <code>Realms</code> that store relevant user/account information. The data obtained from these <code>Realms</code> is used to verify the user’s identity to guarantee the user really is w [...]
+The <code>Authenticator</code> is the component that is responsible for executing and reacting to authentication (log-in) attempts by users. When a user tries to log-in, that logic is executed by the <code>Authenticator</code>. The <code>Authenticator</code> knows how to coordinate with one or more <code>Realms</code> that store relevant user/account information. The data obtained from these <code>Realms</code> is used to verify the user’s identity to guarantee the user really is w [...]
<div class="ulist">
<ul>
<li>
@@ -313,7 +313,7 @@ If more than one <code>Realm</code> is configured, the <code>AuthenticationStrat
</li>
<li>
<p><strong>Authorizer</strong> (<a href="static/current/apidocs/org/apache/shiro/authz/Authorizer.html">org.apache.shiro.authz.Authorizer</a>)
-The <code>Authorizer</code> is the component responsible determining users' access control in the application. It is the mechanism that ultimately says if a user is allowed to do something or not. Like the <code>Authenticator</code>, the <code>Authorizer</code> also knows how to coordinate with multiple back-end data sources to access role and permission information. The <code>Authorizer</code> uses this information to determine exactly if a user is allowed to perform a given action.</p>
+The <code>Authorizer</code> is the component responsible determining users' access control in the application. It is the mechanism that ultimately says if a user is allowed to do something or not. Like the <code>Authenticator</code>, the <code>Authorizer</code> also knows how to coordinate with multiple back-end data sources to access role and permission information. The <code>Authorizer</code> uses this information to determine exactly if a user is allowed to perform a given action. See [...]
</li>
<li>
<p><strong>SessionManager</strong> (<a href="static/current/apidocs/org/apache/shiro/session/mgt/SessionManager.html">org.apache.shiro.session.mgt.SessionManager</a>)
diff --git a/authentication.html b/authentication.html
index 94071b732..acbb4c7c4 100644
--- a/authentication.html
+++ b/authentication.html
@@ -611,6 +611,9 @@ We will cover the <code>Realm</code> authentication behavior shortly.</p>
<div class="sect2">
<h3 id="Authentication-AuthenticationSequence-Authenticator">Authenticator</h3>
<div class="paragraph">
+<p>For a standalone overview of the component, see <a href="authenticator.html">Apache Shiro Authenticators</a>.</p>
+</div>
+<div class="paragraph">
<p>As mentioned earlier, the Shiro <code>SecurityManager</code> implementations default to using a <a href="/static/current/apidocs/org/apache/shiro/authc/pam/ModularRealmAuthenticator.html"><code>ModularRealmAuthenticator</code></a> instance.
The <code>ModularRealmAuthenticator</code> equally supports applications with single Realm as well as those with multiple realms.</p>
</div>
diff --git a/authenticator.html b/authenticator.html
index 672ad43c1..963ee8af1 100644
--- a/authenticator.html
+++ b/authenticator.html
@@ -18,20 +18,26 @@
<html lang="en">
<head>
<meta charset="utf-8"/>
- <title>Authenticator | Apache Shiro</title>
+ <title>Apache Shiro Authenticators | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="keywords" content='documentation,todo,lend-a-hand'>
+ <meta name="description" content="Understanding Apache Shiro Authenticators - the component responsible for verifying user identity. Learn how Authenticators work with Realms and AuthenticationStrategies.">
+ <meta property="og:description" content="Understanding Apache Shiro Authenticators - the component responsible for verifying user identity. Learn how Authenticators work with Realms and AuthenticationStrategies.">
+ <meta name="keywords" content='authenticator,authentication,security,realms'>
<meta name="generator" content="JBake">
<meta name="google-site-verification" content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification" content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
<meta name="google-site-verification" content="gBTYOG8lMfNb_jrWrH3kFbudpEs_WrAJ2lb2-zLRaso"/>
<meta name="msvalidate.01" content="0B57EB46CBFAD8FD45008D2DB6B6C68C">
- <meta property="og:title" content="Authenticator | Apache Shiro"/>
- <meta property="og:type" content="website"/>
- <meta property="article:tag" content='documentation'/>
- <meta property="article:tag" content='todo'/>
- <meta property="article:tag" content='lend-a-hand'/>
+ <meta property="og:title" content="Apache Shiro Authenticators | Apache Shiro"/>
+ <meta property="og:type" content="article"/>
+ <meta name="twitter:card" content="summary" />
+ <meta name="twitter:site" content="@ApacheShiro" />
+ <meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
+ <meta property="article:tag" content='authenticator'/>
+ <meta property="article:tag" content='authentication'/>
+ <meta property="article:tag" content='security'/>
+ <meta property="article:tag" content='realms'/>
<meta property="og:locale" content="en_US" />
<meta property="og:url" content='https://shiro.apache.org/authenticator.html'/>
<meta property="og:image" content='images/shiro-featured-image.png'/>
@@ -196,26 +202,237 @@
</div>
</nav>
- <div class="page-header">
- <h1>Authenticator</h1>
+ <div class="page-header">
+ <h1>Apache Shiro Authenticators</h1>
+ </div>
+
+
+ <div class="admonitionblock tip">
+ <table>
+ <tbody>
+ <tr>
+ <td class="icon">
+ <div class="title">Handy Hint</div>
+ </td>
+ <td class="content">
+ <div class="title">Shiro v1 and v2 version end-of-life notice</div>
+ <div class="paragraph">
+ <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p>
+ <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
</div>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#Authenticator-Role">Role in the SecurityManager</a></li>
+<li><a href="#Authenticator-ModularRealmAuthenticator">ModularRealmAuthenticator</a></li>
+<li><a href="#Authenticator-SingleVsMultipleRealms">Single vs. Multiple Realms</a></li>
+<li><a href="#Authenticator-AuthenticationStrategy">AuthenticationStrategy</a></li>
+<li><a href="#Authenticator-Configuration">Configuration</a></li>
+<li><a href="#Authenticator-RealmInteraction">How Authenticators Work with Realms</a></li>
+<li><a href="#Authenticator-SeeAlso">See Also</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>TODO</p>
+<p>An <code>Authenticator</code> is a component responsible for verifying that a user actually is who they claim to be.
+It is the core component that executes the authentication process on behalf of the <a href="/subject.html">Subject</a>.</p>
</div>
-<hr />
-
-<h2><a id="Lendahandwithdocumentation"></a>Lend a hand with documentation</h2>
-
-<p>While we hope this documentation helps you with the work you're doing with Apache Shiro,
- the community is improving and expanding the documentation all the time.
- If you'd like to help the Shiro project, please consider correcting, expanding, or adding documentation where you see a need.
- Every little bit of help you provide expands the community and in turn improves Shiro. </p>
-
-<p>The easiest way to contribute your documentation is to submit a pull-request by clicking on the <code>Edit</code> link below,
- or send it to the <a href="mailing-lists.html" title="Mailing Lists">User Mailing List</a>.</p>
-
-<hr />
+<div class="paragraph">
+<p>While the <a href="/authentication.html">Authentication</a> documentation explains the concepts and workflow of authentication in Shiro,
+the Authenticator represents the actual implementation component that performs identity verification.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-Role">Role in the SecurityManager</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="/securitymanager.html">SecurityManager</a> does not perform authentication directly.
+Instead, it delegates authentication requests to its internal <code>Authenticator</code> instance.
+When a <a href="/subject.html">Subject</a> calls <a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#login(org.apache.shiro.authc.AuthenticationToken)"><code>login(token)</code></a>,
+the SecurityManager receives the request and immediately delegates to the Authenticator by calling
+<a href="/static/current/apidocs/org/apache/shiro/authc/Authenticator.html#authenticate(org.apache.shiro.authc.AuthenticationToken)"><code>authenticate(token)</code></a>.</p>
+</div>
+<div class="paragraph">
+<p>The Authenticator takes the submitted <a href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationToken.html"><code>AuthenticationToken</code></a>
+and uses it to verify the Subject’s identity.
+If verification succeeds, it returns an <a href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationInfo.html"><code>AuthenticationInfo</code></a> object.
+If verification fails, it throws an <a href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationException.html"><code>AuthenticationException</code></a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-ModularRealmAuthenticator">ModularRealmAuthenticator</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Shiro uses the <a href="/static/current/apidocs/org/apache/shiro/authc/pam/ModularRealmAuthenticator.html"><code>ModularRealmAuthenticator</code></a>
+by default.
+This implementation supports coordinating one or more <a href="/realm.html">Realms</a> during the authentication process.</p>
+</div>
+<div class="paragraph">
+<p>When an authentication token is submitted, the ModularRealmAuthenticator:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Iterates through configured Realms</p>
+</li>
+<li>
+<p>Calls each Realm’s <a href="/static/current/apidocs/org/apache/shiro/realm/Realm.html#supports(org.apache.shiro.authc.AuthenticationToken)"><code>supports(token)</code></a> method to determine if the Realm can process the token</p>
+</li>
+<li>
+<p>If a Realm supports the token, its <a href="/static/current/apidocs/org/apache/shiro/realm/Realm.html#getAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)"><code>getAuthenticationInfo(token)</code></a> method is invoked</p>
+</li>
+<li>
+<p>Returns authentication information if successful, or throws an exception if failed</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-SingleVsMultipleRealms">Single vs. Multiple Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The ModularRealmAuthenticator supports both configurations:</p>
+</div>
+<div class="paragraph">
+<p><strong>Single Realm</strong>:
+When only one Realm is configured, the Authenticator directly invokes that Realm to verify the Subject’s credentials.</p>
+</div>
+<div class="paragraph">
+<p><strong>Multiple Realms</strong>:
+When multiple Realms are configured, the Authenticator uses an <a href="/static/current/apidocs/org/apache/shiro/authc/pam/AuthenticationStrategy.html"><code>AuthenticationStrategy</code></a>
+to determine how to coordinate authentication across the Realms.
+This is a <a href="https://en.wikipedia.org/wiki/Pluggable_Authentication_Modules">PAM</a>-style approach where each Realm can be consulted in sequence.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-AuthenticationStrategy">AuthenticationStrategy</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>When multiple Realms are configured, the Authenticator must determine if the overall authentication attempt succeeds or fails.
+The <a href="/static/current/apidocs/org/apache/shiro/authc/pam/AuthenticationStrategy.html"><code>AuthenticationStrategy</code></a> makes this determination.</p>
+</div>
+<div class="paragraph">
+<p>Shiro provides three built-in strategies:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><strong>FirstSuccessfulStrategy</strong>: Consults Realms in order until one succeeds. Remaining Realms are not consulted.</p>
+</li>
+<li>
+<p><strong>AtLeastOneSuccessfulStrategy</strong>: Returns success if at least one Realm succeeds. Other Realms continue to be consulted.</p>
+</li>
+<li>
+<p><strong>AllSuccessfulStrategy</strong>: All Realms must succeed for authentication to succeed. This is the most restrictive.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>You can configure which strategy the Authenticator uses, or implement your own strategy for custom behavior.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-Configuration">Configuration</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>You can configure a custom Authenticator in your Shiro configuration if needed:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs" data-lang="ini">authenticator = com.foo.bar.CustomAuthenticator
+securityManager.authenticator = $authenticator</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You can also configure the AuthenticationStrategy:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs" data-lang="ini">authenticationStrategy = org.apache.shiro.authc.pam.FirstSuccessfulStrategy
+authenticator.authenticationStrategy = $authenticationStrategy</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>However, in most cases, the default ModularRealmAuthenticator with the default strategy is sufficient for typical applications.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-RealmInteraction">How Authenticators Work with Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authenticator does not directly know how to verify credentials.
+Instead, it coordinates with configured Realms to perform the actual verification.</p>
+</div>
+<div class="paragraph">
+<p>A <a href="/realm.html">Realm</a> is a security-specific data access object that can locate and validate user credentials from a data source
+(database, LDAP, file system, etc.).
+The Realm is responsible for:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Determining if it understands the submitted AuthenticationToken via its <code>supports(token)</code> method</p>
+</li>
+<li>
+<p>Looking up the user in the data source</p>
+</li>
+<li>
+<p>Comparing submitted credentials with those stored in the data source</p>
+</li>
+<li>
+<p>Returning the user’s authentication information if credentials match</p>
+</li>
+<li>
+<p>Throwing an exception if credentials do not match</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>The Authenticator simply orchestrates this process by delegating to Realms in order and handling the results according to its configured strategy.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-SeeAlso">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>To learn more about related topics, see:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="authentication.html">Authentication</a> - Conceptual overview of authentication in Shiro.</p>
+</li>
+<li>
+<p><a href="java-authentication-guide.html">Java Authentication Guide</a> - Practical guide to implementing authentication in your application.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - How Realms connect Shiro to your data sources.</p>
+</li>
+<li>
+<p><a href="authorizer.html">Authorizers</a> - The counterpart component for authorization.</p>
+</li>
+<li>
+<p><a href="securitymanager.html">SecurityManager</a> - The component that orchestrates Authenticators and other Shiro components.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+ <hr />
</div>
diff --git a/authorization.html b/authorization.html
index 560292bee..99bd6df71 100644
--- a/authorization.html
+++ b/authorization.html
@@ -1030,6 +1030,9 @@ public void updateAccount(Account account) {
<div class="sect2">
<h3 id="Authentication-AuthorizingSubjects-ModularRealmAuthorizer">Modular Realm Authorizer</h3>
<div class="paragraph">
+<p>For a standalone overview of the component, see <a href="authorizer.html">Apache Shiro Authorizers</a>.</p>
+</div>
+<div class="paragraph">
<p>As mentioned earlier, the Shiro <code>SecurityManager</code> implementations default to using a <a href="static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html"><code>ModularRealmAuthorizer</code></a> instance. The <code>ModularRealmAuthorizer</code> equally supports applications with single Realm as well as those with multiple realms.</p>
</div>
<div class="paragraph">
diff --git a/authorizer.html b/authorizer.html
index ea4dad0be..8629870dd 100644
--- a/authorizer.html
+++ b/authorizer.html
@@ -18,20 +18,27 @@
<html lang="en">
<head>
<meta charset="utf-8"/>
- <title>Authorizer | Apache Shiro</title>
+ <title>Apache Shiro Authorizers | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="keywords" content='documentation,todo,lend-a-hand'>
+ <meta name="description" content="Understanding Apache Shiro Authorizers - the component that determines what authenticated users are allowed to do. Learn how Authorizers work with Realms to evaluate permissions and roles.">
+ <meta property="og:description" content="Understanding Apache Shiro Authorizers - the component that determines what authenticated users are allowed to do. Learn how Authorizers work with Realms to evaluate permissions and roles.">
+ <meta name="keywords" content='authorizer,authorization,access-control,permissions,roles'>
<meta name="generator" content="JBake">
<meta name="google-site-verification" content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification" content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
<meta name="google-site-verification" content="gBTYOG8lMfNb_jrWrH3kFbudpEs_WrAJ2lb2-zLRaso"/>
<meta name="msvalidate.01" content="0B57EB46CBFAD8FD45008D2DB6B6C68C">
- <meta property="og:title" content="Authorizer | Apache Shiro"/>
- <meta property="og:type" content="website"/>
- <meta property="article:tag" content='documentation'/>
- <meta property="article:tag" content='todo'/>
- <meta property="article:tag" content='lend-a-hand'/>
+ <meta property="og:title" content="Apache Shiro Authorizers | Apache Shiro"/>
+ <meta property="og:type" content="article"/>
+ <meta name="twitter:card" content="summary" />
+ <meta name="twitter:site" content="@ApacheShiro" />
+ <meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
+ <meta property="article:tag" content='authorizer'/>
+ <meta property="article:tag" content='authorization'/>
+ <meta property="article:tag" content='access-control'/>
+ <meta property="article:tag" content='permissions'/>
+ <meta property="article:tag" content='roles'/>
<meta property="og:locale" content="en_US" />
<meta property="og:url" content='https://shiro.apache.org/authorizer.html'/>
<meta property="og:image" content='images/shiro-featured-image.png'/>
@@ -196,26 +203,273 @@
</div>
</nav>
- <div class="page-header">
- <h1>Authorizer</h1>
+ <div class="page-header">
+ <h1>Apache Shiro Authorizers</h1>
+ </div>
+
+
+ <div class="admonitionblock tip">
+ <table>
+ <tbody>
+ <tr>
+ <td class="icon">
+ <div class="title">Handy Hint</div>
+ </td>
+ <td class="content">
+ <div class="title">Shiro v1 and v2 version end-of-life notice</div>
+ <div class="paragraph">
+ <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p>
+ <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
</div>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#Authorizer-Role">Role in the SecurityManager</a></li>
+<li><a href="#Authorizer-ModularRealmAuthorizer">ModularRealmAuthorizer</a></li>
+<li><a href="#Authorizer-PermissionAndRoleChecks">Permission and Role Checks</a>
+<ul class="sectlevel2">
+<li><a href="#Authorizer-PermissionChecks">Permission Checks</a></li>
+<li><a href="#Authorizer-RoleChecks">Role Checks</a></li>
+</ul>
+</li>
+<li><a href="#Authorizer-Configuration">Configuration</a></li>
+<li><a href="#Authorizer-RealmInteraction">How Authorizers Work with Realms</a></li>
+<li><a href="#Authorizer-MultipleRealms">Authorization with Multiple Realms</a></li>
+<li><a href="#Authorizer-SeeAlso">See Also</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>TODO</p>
+<p>An <code>Authorizer</code> is a component responsible for determining whether a user is allowed to perform a certain action.
+It evaluates whether a <code>Subject</code> has the necessary permissions or roles to access a resource or perform an operation.</p>
</div>
-<hr />
-
-<h2><a id="Lendahandwithdocumentation"></a>Lend a hand with documentation</h2>
-
-<p>While we hope this documentation helps you with the work you're doing with Apache Shiro,
- the community is improving and expanding the documentation all the time.
- If you'd like to help the Shiro project, please consider correcting, expanding, or adding documentation where you see a need.
- Every little bit of help you provide expands the community and in turn improves Shiro. </p>
+<div class="paragraph">
+<p>While the <a href="/authorization.html">Authorization</a> documentation explains the concepts and workflow of access control in Shiro,
+the Authorizer represents the actual implementation component that performs access control decisions.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-Role">Role in the SecurityManager</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="/securitymanager.html">SecurityManager</a> does not perform authorization checks directly.
+Instead, it delegates authorization decisions to its internal <code>Authorizer</code> instance.
+When a <a href="/subject.html">Subject</a> calls authorization methods such as
+<a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)"><code>hasRole(role)</code></a>,
+<a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)"><code>isPermitted(permission)</code></a>,
+or their variants, the SecurityManager delegates to the Authorizer.</p>
+</div>
+<div class="paragraph">
+<p>The Authorizer determines whether the Subject is permitted to perform the requested action by checking the Subject’s roles and permissions.
+If the Subject has the necessary role or permission, the authorization check passes.
+If not, an <a href="/static/current/apidocs/org/apache/shiro/authz/AuthorizationException.html"><code>AuthorizationException</code></a> may be thrown.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-ModularRealmAuthorizer">ModularRealmAuthorizer</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Shiro uses the <a href="/static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html"><code>ModularRealmAuthorizer</code></a>
+by default.
+This implementation supports coordinating one or more <a href="/realm.html">Realms</a> during the authorization process.</p>
+</div>
+<div class="paragraph">
+<p>When an authorization check is performed, the ModularRealmAuthorizer:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Iterates through configured Realms</p>
+</li>
+<li>
+<p>For each Realm that implements the <code>Authorizer</code> interface, calls the corresponding authorization method
+(<code>hasRole*</code>, <code>checkRole*</code>, <code>isPermitted*</code>, or <code>checkPermission*</code>)</p>
+</li>
+<li>
+<p>Aggregates and evaluates the results according to Shiro’s authorization semantics</p>
+</li>
+<li>
+<p>Returns the authorization decision to the caller</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>It is important to note that the ModularRealmAuthorizer treats Realms differently depending on whether they implement the <code>Authorizer</code> interface.
+If a Realm does not implement <code>Authorizer</code>, it is not consulted for authorization checks.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-PermissionAndRoleChecks">Permission and Role Checks</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authorizer performs two types of authorization checks:</p>
+</div>
+<div class="sect2">
+<h3 id="Authorizer-PermissionChecks">Permission Checks</h3>
+<div class="paragraph">
+<p>Permission checks verify whether a Subject is allowed to perform a specific action on a specific resource.
+Methods for permission checks include:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)"><code>isPermitted(permission)</code></a> - returns <code>true</code> or <code>false</code></p>
+</li>
+<li>
+<p><a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission(org.apache.shiro.authz.Permission)"><code>checkPermission(permission)</code></a> - throws an exception on failure</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>For example:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs" data-lang="java">if (subject.isPermitted("account:read")) {
+ //User can read accounts
+}
-<p>The easiest way to contribute your documentation is to submit a pull-request by clicking on the <code>Edit</code> link below,
- or send it to the <a href="mailing-lists.html" title="Mailing Lists">User Mailing List</a>.</p>
+subject.checkPermission("document:delete:report123");</code></pre>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="Authorizer-RoleChecks">Role Checks</h3>
+<div class="paragraph">
+<p>Role checks verify whether a Subject has a specific role. Methods for role checks include:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)"><code>hasRole(role)</code></a> - returns <code>true</code> or <code>false</code></p>
+</li>
+<li>
+<p><a href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRole(java.lang.String)"><code>checkRole(role)</code></a> - throws an exception on failure</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>For example:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs" data-lang="java">if (subject.hasRole("admin")) {
+ //User is an administrator
+}
-<hr />
+subject.checkRole("user");</code></pre>
+</div>
+</div>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-Configuration">Configuration</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>You can configure a custom Authorizer in your Shiro configuration if needed:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs" data-lang="ini">authorizer = com.foo.bar.CustomAuthorizer
+securityManager.authorizer = $authorizer</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>However, in most cases, the default ModularRealmAuthorizer is sufficient for typical applications.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-RealmInteraction">How Authorizers Work with Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authorizer does not directly know where to retrieve authorization data.
+Instead, it coordinates with configured Realms to perform the actual authorization checks.</p>
+</div>
+<div class="paragraph">
+<p>A <a href="/realm.html">Realm</a> is a security-specific data access object that knows how to retrieve authorization data from a data source
+(database, LDAP, file system, etc.).
+The Realm is responsible for:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Determining if it implements the <code>Authorizer</code> interface (which indicates it can perform authorization checks)</p>
+</li>
+<li>
+<p>Retrieving the Subject’s roles and permissions from the data source</p>
+</li>
+<li>
+<p>Evaluating whether the Subject has the requested role or permission</p>
+</li>
+<li>
+<p>Returning the results of the authorization check</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>The Authorizer simply orchestrates this process by delegating to Realms and aggregating their results.
+This allows you to use multiple Realms where authorization data may come from different sources,
+and Shiro will coordinate the results appropriately.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-MultipleRealms">Authorization with Multiple Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>When multiple Realms are configured, the ModularRealmAuthorizer consults all Realms that implement the <code>Authorizer</code> interface.
+The results are aggregated to determine the final authorization decision.</p>
+</div>
+<div class="paragraph">
+<p>Typically, if any Realm grants permission or role membership, the authorization check succeeds.
+However, the exact behavior depends on the authorization data model and how the Realms are configured.
+Custom Authorizer implementations can be used to implement different aggregation strategies if needed.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-SeeAlso">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>To learn more about related topics, see:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="authorization.html">Authorization</a> - Conceptual overview of authorization in Shiro.</p>
+</li>
+<li>
+<p><a href="java-authorization-guide.html">Java Authorization Guide</a> - Practical guide to implementing authorization in your application.</p>
+</li>
+<li>
+<p><a href="permissions.html">Permissions</a> - Understanding Shiro’s permission model.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - How Realms connect Shiro to your data sources.</p>
+</li>
+<li>
+<p><a href="authenticator.html">Authenticators</a> - The counterpart component for authentication.</p>
+</li>
+<li>
+<p><a href="securitymanager.html">SecurityManager</a> - The component that orchestrates Authorizers and other Shiro components.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+ <hr />
</div>
diff --git a/documentation.html b/documentation.html
index 78b3941f4..babb55815 100644
--- a/documentation.html
+++ b/documentation.html
@@ -230,7 +230,12 @@
<h2 id="introduction">Introduction</h2>
<div class="sectionbody">
<div class="paragraph">
-<p>Helpful if read in order:</p>
+<p>This page serves as the central hub for all Apache Shiro documentation. Whether you are just getting started or looking for detailed reference material, you will find links to the appropriate resources here.</p>
+</div>
+<div class="sect2">
+<h3 id="new_to_shiro">New to Shiro?</h3>
+<div class="paragraph">
+<p>If you are new to Apache Shiro, we recommend reading these resources in order:</p>
</div>
<div class="ulist">
<ul>
@@ -238,16 +243,20 @@
<p><a href="https://www.infoq.com/articles/apache-shiro">Application Security with Apache Shiro</a> - full intro article on InfoQ.com</p>
</li>
<li>
-<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a></p>
+<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a> - quick hands-on introduction</p>
</li>
<li>
-<p><a href="webapp-tutorial.html">Beginner’s Webapp Tutorial: a step-by-step tutorial to enable Shiro in a web application</a></p>
+<p><a href="webapp-tutorial.html">Beginner’s Webapp Tutorial</a> - step-by-step guide to enable Shiro in a web application</p>
</li>
<li>
<p><a href="https://start.flowlogix.com">Flowlogix Starter</a> - generate Jakarta EE projects with Shiro support</p>
</li>
</ul>
</div>
+<div class="paragraph">
+<p>Once you understand the basics, explore the <a href="guides.html">Guides</a> page for a complete learning path.</p>
+</div>
+</div>
</div>
</div>
<div class="sect1">
@@ -258,7 +267,7 @@
<div class="ulist">
<ul>
<li>
-<p><a href="reference.html">Reference Manual</a></p>
+<p><a href="reference.html">Reference Manual</a> - comprehensive reference covering all Shiro concepts and features</p>
</li>
</ul>
</div>
@@ -309,6 +318,12 @@
</li>
</ul>
</div>
+</div>
+<div class="sect2">
+<h3 id="upgrading">Upgrading?</h3>
+<div class="paragraph">
+<p>If you are upgrading from an earlier version of Shiro, see the <a href="migration-guide.html">Migration Guide</a> for important changes and upgrade instructions.</p>
+</div>
<h2 id="Lendahandwithdocumentation">Lend a hand with documentation</h2>
<p>While we hope this documentation helps you with the work you're doing with Apache Shiro, the community is improving and expanding the documentation all the time. If you'd like to help the Shiro project, please consider correcting, expanding, or adding documentation where you see a need. Every little bit of help you provide expands the community and in turn improves Shiro. </p>
diff --git a/feed.xml b/feed.xml
index e83929e0d..f3322b9fe 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml" />
- <updated>2026-09-26T17:08:16Z</updated>
+ <updated>2026-10-11T06:06:48Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/get-started.html b/get-started.html
index 8f682921c..bd607c024 100644
--- a/get-started.html
+++ b/get-started.html
@@ -287,6 +287,45 @@ Articles and Guides written by and for members of the Apache Shiro community.</p
</ul>
</div>
</div>
+</div>
+<div class="sect1">
+<h2 id="next_steps">Next Steps</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Once you have completed the tutorials above, consider exploring these topics:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="guides.html">All Guides</a> - Browse the complete collection of Shiro guides.</p>
+</li>
+<li>
+<p><a href="reference.html">Reference Documentation</a> - Comprehensive reference covering all Shiro features.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - Learn how to connect Shiro to your user data sources.</p>
+</li>
+<li>
+<p><a href="migration-guide.html">Migration Guide</a> - If you are upgrading from an older Shiro version.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="need_help">Need Help?</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="mailing-lists.html">Mailing Lists</a> - Ask questions and get help from the community.</p>
+</li>
+<li>
+<p><a href="issues.html">Issue Tracker</a> - Report bugs or request features.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/guides.html b/guides.html
index e577776ed..2d54184df 100644
--- a/guides.html
+++ b/guides.html
@@ -226,27 +226,105 @@
</table>
</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>Here are some basic guides on how to use Shiro.</p>
+<p>This page collects the primary guides for learning Apache Shiro. Whether you are new to Shiro or looking to deepen your understanding, these guides provide practical, step-by-step instructions.</p>
</div>
<div class="paragraph">
<p>Please post any errata to the user or dev mailing lists.</p>
</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="getting_started">Getting Started</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>If you are new to Shiro, start here:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a> - A quick hands-on introduction to Shiro’s core API and concepts.</p>
+</li>
+<li>
+<p><a href="tutorial.html">Your First Shiro Application</a> - Build a simple application secured by Shiro from scratch.</p>
+</li>
+<li>
+<p><a href="webapp-tutorial.html">Beginner’s Webapp Tutorial</a> - A step-by-step guide to enabling Shiro in a web application.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="core_concepts">Core Concepts</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Once you understand the basics, explore these guides to learn how authentication and authorization work in Shiro:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="java-authentication-guide.html">Authentication Guide</a> - Learn how to verify user identity using Shiro’s authentication API.</p>
+</li>
+<li>
+<p><a href="java-authorization-guide.html">Authorization Guide</a> - Understand how to control access to resources based on roles and permissions.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="advanced_topics">Advanced Topics</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>After mastering the core concepts, consider these topics:</p>
+</div>
<div class="ulist">
<ul>
<li>
-<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a></p>
+<p><a href="realm.html">Realm Guide</a> - Learn how Realms connect Shiro to your user data sources.</p>
</li>
<li>
-<p><a href="java-authentication-guide.html">Authentication Guide</a></p>
+<p><a href="session-management.html">Session Management</a> - Understand how Shiro manages user sessions across environments.</p>
</li>
<li>
-<p><a href="java-authorization-guide.html">Authorization Guide</a></p>
+<p><a href="cryptography.html">Cryptography</a> - Explore Shiro’s simplified cryptography APIs.</p>
</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="upgrading_shiro">Upgrading Shiro</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
<li>
-<p><a href="migration-guide.html">Migration Guide: Upgrading Shiro 1.x → 2.x → 3.x</a></p>
+<p><a href="migration-guide.html">Migration Guide: Upgrading Shiro 1.x → 2.x → 3.x</a> - Step-by-step instructions for upgrading between major Shiro versions.</p>
</li>
</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="reference.html">Reference Documentation</a> - Complete reference for all Shiro features.</p>
+</li>
+<li>
+<p><a href="documentation.html">Documentation Hub</a> - Central hub for all Shiro documentation resources.</p>
+</li>
+<li>
+<p><a href="articles.html">Community Articles</a> - Articles and tutorials contributed by the Shiro community.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/issues.html b/issues.html
index 1aba1e9dc..bd8c9aacf 100644
--- a/issues.html
+++ b/issues.html
@@ -20,9 +20,9 @@
<meta charset="utf-8"/>
<title>Apache Shiro Bug & Issue Tracking | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="description" content="Report bugs, request features, and track issues for Apache Shiro using GitHub Issues tracking system.">
- <meta property="og:description" content="Report bugs, request features, and track issues for Apache Shiro using GitHub Issues tracking system.">
- <meta name="keywords" content='issues,bugs,jira,bug-tracking,support'>
+ <meta name="description" content="Report bugs, request features, and track issues for Apache Shiro using GitHub Issues.">
+ <meta property="og:description" content="Report bugs, request features, and track issues for Apache Shiro using GitHub Issues.">
+ <meta name="keywords" content='issues,bugs,bug-tracking,support'>
<meta name="generator" content="JBake">
<meta name="google-site-verification" content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification" content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
@@ -36,7 +36,6 @@
<meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
<meta property="article:tag" content='issues'/>
<meta property="article:tag" content='bugs'/>
- <meta property="article:tag" content='jira'/>
<meta property="article:tag" content='bug-tracking'/>
<meta property="article:tag" content='support'/>
<meta property="og:locale" content="en_US" />
diff --git a/java-authentication-guide.html b/java-authentication-guide.html
index 6260469c6..886e89fe5 100644
--- a/java-authentication-guide.html
+++ b/java-authentication-guide.html
@@ -244,6 +244,7 @@
</ul>
</li>
<li><a href="#logging_out">Logging Out</a></li>
+<li><a href="#see_also">See Also</a></li>
</ul>
</div>
<div id="preamble">
@@ -496,6 +497,33 @@ After the login, your identity has been verified and <code>isAuthenticated()=TRU
<p>When you log out in Shiro it will close out the user session and removes any associated identity from the subject instance. If you’re using RememberMe in a web environment, then <code>.logout()</code> will, by default, also delete the RememberMe cookie from the browser.</p>
</div>
</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Now that you understand authentication in Shiro, continue learning with these resources:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="java-authorization-guide.html">Java Authorization Guide</a> - Learn how to control access to resources after authentication.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - Learn how to connect Shiro to your user data sources.</p>
+</li>
+<li>
+<p><a href="authentication.html">Authentication Concepts</a> - Deeper dive into Shiro’s authentication architecture.</p>
+</li>
+<li>
+<p><a href="authenticator.html">Authenticators</a> - Understand the component that performs authentication.</p>
+</li>
+<li>
+<p><a href="subject.html">Subject</a> - Learn more about the Subject API.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/java-authorization-guide.html b/java-authorization-guide.html
index 69d0862c6..bc0e87acb 100644
--- a/java-authorization-guide.html
+++ b/java-authorization-guide.html
@@ -533,7 +533,34 @@ public void openAccount( Account acct ) {
<h2 id="caching_authorization">Caching Authorization</h2>
<div class="sectionbody">
<div class="paragraph">
-<p>TBD</p>
+<p>Shiro supports caching authorization data to improve performance. When authorization checks are performed frequently, caching avoids repeated lookups to the underlying data source. For more information on how caching works in Shiro, see the <a href="caching.html">Caching Documentation</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Now that you understand authorization in Shiro, continue learning with these resources:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="permissions.html">Permissions</a> - Deep dive into Shiro’s permission model.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - Learn how Realms provide authorization data.</p>
+</li>
+<li>
+<p><a href="authorization.html">Authorization Concepts</a> - Deeper dive into Shiro’s authorization architecture.</p>
+</li>
+<li>
+<p><a href="authorizer.html">Authorizers</a> - Understand the component that performs authorization.</p>
+</li>
+<li>
+<p><a href="java-authentication-guide.html">Java Authentication Guide</a> - If you haven’t already, learn about authentication.</p>
+</li>
+</ul>
</div>
</div>
</div>
diff --git a/reference.html b/reference.html
index 088b0cd45..4a89af598 100644
--- a/reference.html
+++ b/reference.html
@@ -226,6 +226,25 @@
</table>
</div>
+<div id="preamble">
+<div class="sectionbody">
+<div class="paragraph">
+<p>This reference manual provides comprehensive documentation for all Apache Shiro features. Use this as your primary reference when implementing security in your applications.</p>
+</div>
+<div class="admonitionblock tip">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-tip" title="Tip"></i>
+</td>
+<td class="content">
+<div class="paragraph">
+<p>If you are new to Shiro, we recommend starting with the <a href="10-minute-tutorial.html">10 Minute Tutorial</a> or the <a href="guides.html">Guides</a> before diving into the reference material.</p>
+</div>
+</td>
+</tr>
+</table>
+</div>
<div class="olist arabic">
<ol class="arabic">
<li>
@@ -361,6 +380,26 @@
</div>
</li>
</ol>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="guides.html">Guides</a> - Tutorials and step-by-step instructions.</p>
+</li>
+<li>
+<p><a href="documentation.html">Documentation Hub</a> - Central hub for all Shiro documentation.</p>
+</li>
+<li>
+<p><a href="migration-guide.html">Migration Guide</a> - For users upgrading between major versions.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/sitemap.xml b/sitemap.xml
index 3ead291f8..70ad7d6b3 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -56,6 +56,10 @@
<loc>https://shiro.apache.org/get-started.html</loc>
<lastmod>2010-03-18</lastmod>
</url>
+ <url>
+ <loc>https://shiro.apache.org/authorizer.html</loc>
+ <lastmod>2010-03-18</lastmod>
+ </url>
<url>
<loc>https://shiro.apache.org/java-cryptography-guide.html</loc>
<lastmod>2010-03-18</lastmod>
@@ -112,6 +116,10 @@
<loc>https://shiro.apache.org/commercial-support.html</loc>
<lastmod>2010-03-18</lastmod>
</url>
+ <url>
+ <loc>https://shiro.apache.org/authenticator.html</loc>
+ <lastmod>2010-03-18</lastmod>
+ </url>
<url>
<loc>https://shiro.apache.org/what-is-shiro.html</loc>
<lastmod>2010-03-18</lastmod>
@@ -568,14 +576,6 @@
<loc>https://shiro.apache.org/release-archive.html</loc>
<lastmod>2022-06-28</lastmod>
</url>
- <url>
- <loc>https://shiro.apache.org/authorizer.html</loc>
- <lastmod>2026-05-25</lastmod>
- </url>
- <url>
- <loc>https://shiro.apache.org/authenticator.html</loc>
- <lastmod>2026-05-25</lastmod>
- </url>
<url>
<loc>https://shiro.apache.org/team.html</loc>
<lastmod>2023-02-08</lastmod>