You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@causeway.apache.org by da...@apache.org on 2023/07/03 10:09:46 UTC
[causeway] branch CAUSEWAY-3513 updated: CAUSEWAY-3513: updates docs
This is an automated email from the ASF dual-hosted git repository.
danhaywood pushed a commit to branch CAUSEWAY-3513
in repository https://gitbox.apache.org/repos/asf/causeway.git
The following commit(s) were added to refs/heads/CAUSEWAY-3513 by this push:
new b822cc713a CAUSEWAY-3513: updates docs
b822cc713a is described below
commit b822cc713abb38ddc14b51e34d0025e17704af5a
Author: danhaywood <da...@haywood-associates.co.uk>
AuthorDate: Mon Jul 3 11:09:28 2023 +0100
CAUSEWAY-3513: updates docs
---
.../ROOT/partials/module-nav/extensions.adoc | 1 -
antora/playbooks/site-extensions.yml | 3 ---
antora/playbooks/site.yml | 3 ---
security/adoc/modules/ROOT/pages/about.adoc | 1 -
.../adoc/modules/ROOT/partials/extensions.adoc | 1 -
.../src/main/adoc/modules/shiro/pages/about.adoc | 22 +++++++++++-----------
6 files changed, 11 insertions(+), 20 deletions(-)
diff --git a/antora/components/docs/modules/ROOT/partials/module-nav/extensions.adoc b/antora/components/docs/modules/ROOT/partials/module-nav/extensions.adoc
index 1005321da3..a88da7528e 100644
--- a/antora/components/docs/modules/ROOT/partials/module-nav/extensions.adoc
+++ b/antora/components/docs/modules/ROOT/partials/module-nav/extensions.adoc
@@ -20,7 +20,6 @@
*** xref:security:secman:about.adoc[]
*** xref:security:audittrail:about.adoc[]
*** xref:security:spring-oauth2:about.adoc[Spring OAuth2]
-*** xref:security:shiro-realm-ldap:about.adoc[LDAP Realm for Shiro]
*** xref:security:sessionlog:about.adoc[]
diff --git a/antora/playbooks/site-extensions.yml b/antora/playbooks/site-extensions.yml
index 3cacd11a94..666acc9bda 100644
--- a/antora/playbooks/site-extensions.yml
+++ b/antora/playbooks/site-extensions.yml
@@ -68,9 +68,6 @@ content:
- url: .
start_path: extensions/security/sessionlog/adoc # security
branches: HEAD
- - url: .
- start_path: extensions/security/shiro-realm-ldap/adoc # security
- branches: HEAD
- url: .
start_path: extensions/security/spring-oauth2/src/main/adoc # security
branches: HEAD
diff --git a/antora/playbooks/site.yml b/antora/playbooks/site.yml
index 3abbb7a495..3131d1c1e9 100644
--- a/antora/playbooks/site.yml
+++ b/antora/playbooks/site.yml
@@ -136,9 +136,6 @@ content:
- url: .
start_path: extensions/security/sessionlog/adoc # security
branches: HEAD
- - url: .
- start_path: extensions/security/shiro-realm-ldap/adoc # security
- branches: HEAD
- url: .
start_path: extensions/security/spring-oauth2/src/main/adoc # security
branches: HEAD
diff --git a/security/adoc/modules/ROOT/pages/about.adoc b/security/adoc/modules/ROOT/pages/about.adoc
index 5a18b9339d..f5b61afd82 100644
--- a/security/adoc/modules/ROOT/pages/about.adoc
+++ b/security/adoc/modules/ROOT/pages/about.adoc
@@ -33,7 +33,6 @@ include::security:spring:partial$module-nav.adoc[]
In addition to the security SPI implementations, there are a number of security-related extensions:
* The xref:security:spring-oauth2:about.adoc[Spring OAuth2] extension configures the xref:security:spring:about.adoc[Spring authenticator] for OAuth2 stores (eg gmail, facebook)
-* The xref:security:shiro-realm-ldap:about.adoc[LDAP Realm] extension confiures the xref:security:shiro:about.adoc[Shiro authenticator] to use LDAP as a credential source.
* The xref:security:secman:about.adoc[SecMan extension] provides both an authenticator and an authorizor from domain entities (users, roles and permission entities) using either xref:pjpa:ROOT:about.adoc[JPA] or xref:pjdo:ROOT:about.adoc[JDO].
+
As these users, roles and permissions are domain objects, they can be administered through Apache Causeway itself.
diff --git a/security/adoc/modules/ROOT/partials/extensions.adoc b/security/adoc/modules/ROOT/partials/extensions.adoc
index 99032474c2..3c54c08d70 100644
--- a/security/adoc/modules/ROOT/partials/extensions.adoc
+++ b/security/adoc/modules/ROOT/partials/extensions.adoc
@@ -1,6 +1,5 @@
include::security:secman:partial$module-nav.adoc[]
include::security:audittrail:partial$module-nav.adoc[]
include::security:spring-oauth2:partial$module-nav.adoc[]
-include::security:shiro-realm-ldap:partial$module-nav.adoc[]
include::security:sessionlog:partial$module-nav.adoc[]
diff --git a/security/shiro/src/main/adoc/modules/shiro/pages/about.adoc b/security/shiro/src/main/adoc/modules/shiro/pages/about.adoc
index dd5ca982d0..96d1d4dc3b 100644
--- a/security/shiro/src/main/adoc/modules/shiro/pages/about.adoc
+++ b/security/shiro/src/main/adoc/modules/shiro/pages/about.adoc
@@ -24,12 +24,11 @@ Configuring this realm is described <<shiro-ini-realm,below>>
TIP: The xref:docs:starters:helloworld.adoc[HelloWorld] and xref:docs:starters:simpleapp.adoc[SimpleApp] starter apps are both configured to use this realm.
-A more sophisticated option is the LDAP realm.
-Shiro has its own implementation which is extended in the xref:security:shiro-realm-ldap:about.adoc[LDAP realm]
-This realm also supports permissions.
+For production use, a more sophisticated option is the LDAP realm.
+Shiro has its own implementation which can be used for authentication.
+We recommend that it is combined with xref:security:secman:about.adoc[] for authorization.
+See xref:security:secman:setting-up-with-shiro.adoc[setting up SecMan with Shiro] for more details.
-Permissions are ultimately represented as strings, and their interpretation of them is the responsibility of `AuthorizorShiro`.
-An enhanced "wildcard" syntax, described <<enhanced-wildcard-permission,below>> in more detail, incorporates the notion of read and write permissions, and also of vetoing permissions (as well as the usual allow permissions).
[[configuring-causeway-to-use-shiro]]
@@ -96,7 +95,8 @@ securityManager.realms = $realm1,$realm2
----
How to configure the text-based ini realm is explained <<shiro-ini-realm,below>>.
-Another option alternative is the xref:security:shiro-realm-ldap:about.adoc[LDAP realm].
+Another option alternative is Shiro's own LDAP realm, which can be used for authentication and combined with SecMan for authorization.
+See xref:security:secman:setting-up-with-shiro.adoc[setting up SecMan with Shiro] for more details.
As noted above, as well as realms many other aspects of configuration can be specified in this file:
@@ -280,14 +280,12 @@ Instead, the corresponding sections from for `realm1.ini` are used instead.
[#enhanced-wildcard-permission]
== Enhanced Wildcard Permission
-If using the text-based xref:security:shiro:about.adoc#shiro-ini-realm[IniRealm] or xref:security:shiro-realm-ldap:about.adoc[Apache Causeway' LDAP realm], then note that Shiro also allows the string representation of the permissions to be mapped (resolved) to alternative `Permission` instances.
-Apache Causeway provides its own `CausewayPermission` which introduces the concept of a "veto".
+If using xref:security:shiro:about.adoc#shiro-ini-realm[IniRealm], the string permissions can represent either a grant _or_ a veto for a particular feature.
-A vetoing permission is one that prevents access to a feature, rather than grants it.
This is useful in some situations where most users have access to most features, and only a small number of features are particularly sensitive.
The configuration can therefore be set up to grant fairly broad-brush permissions and then veto permission for the sensitive features for those users that do not have access.
-The string representation of the `CausewayPermission` uses the following format:
+The string representation of a "causeway" permission (implemented, in fact, by the xref:refguide:security:index/shiro/authorization/CausewayPermission.adoc[] class) uses the following format:
[source,ini]
----
@@ -329,6 +327,7 @@ In this case the prefixes in ``reg/{asterisk}`` and ``adm/{asterisk}`` are requi
The net effect is therefore what we would want: that a user with both `admin_role` and `user_role` would have access to everything, irrespective of those two veto permissions of the `user_role`.
+
[[permission-resolver-configuration]]
=== Configuration
@@ -339,7 +338,7 @@ To configure Apache Causeway' extended permission support requires that a custom
permissionResolver = org.apache.causeway.security.shiro.authorization.CausewayPermissionResolver
myRealm.permissionResolver = $permissionResolver # <.>
----
-<.> `myRealm` is the handle to the configured realm, eg `$iniRealm` or `$causewayLdapRealm` etc.
+<.> `myRealm` is the handle to the configured realm, eg `$iniRealm`.
@@ -357,6 +356,7 @@ securityManager.cacheManager = $memoryCacheManager
Other implementations can be plugged in; see the Shiro link:http://shiro.apache.org/caching.html[documentation] for further details.
+
== Further Reading
Shiro provides many other features.